Beefy Boxes and Bandwidth Generously Provided by pair Networks chromatic writing perl on a camel
Welcome to the Monastery

Re: tshark RTCP capture via PERL

by jettero (Monsignor)
on Nov 08, 2011 at 11:43 UTC ( #936756=note: print w/ replies, xml ) Need Help??

in reply to tshark RTCP capture via PERL

Tshark, wireshark, and tcpdump are all the same thing. They use libpcap to capture network data and dump it to files. The main difference is that tshark and wireshark have all kinds of slick decoders built right in.

For realtime captures and things, choose Net::Pcap::Easy. I wrote this module. Mostly people are turned of by the word Easy, and I can't blame them, but I think I've done a reasonable job making it easier for me to use. The main thing was to get all the information you need on one manpage.

The real work is in Net::Pcap. It uses NetPacket to do decodes… I find it rather difficult to use in the raw, for one thing the truth values are backwards (like in C) and for another the documentation spans many man pages, but this is surely the more traditional way to do it. I'm also peripherally aware of a POE module that does event based pcaps.

Anyway, I highly recommend you do this a little more natively, rather than trying to grok the random outputs of tshark. Those could change without any notice at all (even just moving from machine to machine) and then you'll have to go back and tweak your regexps and things.

Comment on Re: tshark RTCP capture via PERL
Re^2: tshark RTCP capture via PERL
by FirtyFree (Initiate) on Nov 08, 2011 at 13:10 UTC

    Hi Jettero

    Many thanks for responding, the main reason for using tshark, I guess is a lazy one, I can apply simple thresholds to the various rTCP fields that I am interested in to cut down the amount of traffic reported (I am not interested in capturing all traffic due to the volume) - the source of the rTCP data should be sending out senders reports every 5 secs so perhaps this is not an issue.

    I'll definately take a look at your suggestion as I would certainly like to control this natively as you suggested rather than via pipe, I was just a bit worried about the load produced when having to filter through all traffic manually, do you see any problems with this?

    TSHARK has failed me a little as I wanted to capture ALL SDES Item 'text' fields but unfortunately it only seems to return the last 'text' field using the 'rtcp.sdes.text' filter so I am hoping your method would give me the ability to return them all, that would be a big plus also for me

    Thanks again!

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://936756]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others cooling their heels in the Monastery: (10)
As of 2014-04-18 17:42 GMT
Find Nodes?
    Voting Booth?

    April first is:

    Results (471 votes), past polls