<?xml version="1.0" encoding="windows-1252"?>
<node id="995535" title="Re: decoding libpcap on windows" created="2012-09-25 08:18:04" updated="2012-09-25 08:18:04">
<type id="11">
note</type>
<author id="749850">
VinsWorldcom</author>
<data>
<field name="doctext">
&lt;p&gt;Without and example of the " format to be inserted into a database for analysis", I don't know what you're trying to output.&lt;/p&gt;

&lt;p&gt;The NetPacket::* modules seem old by copyright date.  You may want to have a look at the Net::Frame modules.  They provide packet encode/decode at various OSI layers and specifically, you'll want to look at Net::Frame::Dump and it's sub-modules.  The example provided with the distribution (dump-offline.pl) may be what you're looking for:&lt;/p&gt;

&lt;c&gt;
VinsWorldcom@C:\Users\VinsWorldcom\tmp&gt; dump-offline.pl test.pcap
o Frame number: 0 (length: 42)
ETH: dst:ff:ff:ff:ff:ff:ff  src:cc:18:ff:77:88:99  type:0x0806
ARP: hType:0x0001  pType:0x0800  hSize:0x06  pSize:0x04  opCode:0x0001
ARP: src:c4:17:fe:12:7d:75  srcIp:192.168.10.100
ARP: dst:00:00:00:00:00:00  dstIp:192.168.10.20
o Frame number: 1 (length: 59)
ETH: dst:68:69:70:71:77:90  src:cc:18:ff:77:88:99  type:0x0800
IPv4: version:4  hlen:5  tos:0x00  length:45  id:8608
IPv4: flags:0x02  offset:0  ttl:128  protocol:0x06  checksum:0x9072
IPv4: src:192.168.10.100  dst:64.5.62.248
TCP: src:54237  dst:1863  seq:0x322c9b85  ack:0x119cfd35
TCP: off:0x05  x2:0x0  flags:0x18  win:16677  checksum:0xcce5  urp:0x00
TCP: payload:504d570d0a

...
&lt;/c&gt;
</field>
<field name="root_node">
995527</field>
<field name="parent_node">
995527</field>
</data>
</node>
