---
name: "Net::Frame::Dump::Offline"
section: "3pm"
platform: "linux"
package: "libnet-frame-dump-perl"
version: "1.18-2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/Net::Frame::Dump::Offline"
---

# Net::Frame::Dump::Offline(3pm)

tcpdump like implementation, offline mode

## NAME

Net::Frame::Dump::Offline - tcpdump like implementation, offline mode

## SYNOPSIS

```
   use Net::Frame::Dump::Offline;
   #
   # Simple offline anaysis
   #
   my $oDump = Net::Frame::Dump::Offline->new(file => $file);
   $oDump->start;
   my $count = 0;
   while (my $h = $oDump->next) {
      my $f = Net::Frame::Simple->new(
         raw        => $h->{raw},
         firstLayer => $h->{firstLayer},
         timestamp  => $h->{timestamp},
      );
      my $len = length($h->{raw});
      print 'o Frame number: '.$count++." (length: $len)\n";
      print $f->print."\n";
   }
   $oDump->stop;
   #
   # Default parameters on creation
   #
   my $oDumpDefault = Net::Frame::Dump::Offline->new(
      file          => "netframe-tmp-$$.$int.pcap",
      filter        => '',
      isRunning     => 0,
      keepTimestamp => 0,
   );
```

## DESCRIPTION

This module implements a tcpdump-like program, for offline analysis.

## ATTRIBUTES

The following are inherited attributes:

- **file**

  Name of the .pcap file to read.

- **filter**

  Pcap filter to use. Default to no filter.

- **firstLayer**

  Stores information about the first layer type contained on read frame. This attribute is filled only after a call to **start** method.

- **isRunning**

  Returns true if a call to start has been done, false otherwise or if a call to stop has been done.

- **keepTimestamp**

  Sometimes, when frames are captured and saved to a .pcap file, timestamps sucks. That is, you send a frame, and receive the reply, but your request appear to have been sent after the reply. So, to correct that, you can use **Net::Frame::Dump** own timestamping system. The default is 0. Set it manually to 1 if you need original .pcap frames timestamps.

## METHODS

- **new**

  - **new** (hash)

  Object constructor. You can pass attributes that will overwrite default ones. See **SYNOPSIS** for default values.

- **start**

  When you want to start reading frames from the file, call this method.

- **stop**

  When you want to stop reading frames from the file, call this method.

- **next**

  Returns the next captured frame; undef if no more frames are awaiting.

- **store** (**Net::Frame::Simple** object)

  This method will store internally, sorted, the **Net::Frame::Simple** object passed as a single parameter. **getKey** methods, implemented in various **Net::Frame::Layer** objects will be used to efficiently retrieve (via **getKeyReverse** method) frames.

  Basically, it is used to make **recv** method (from **Net::Frame::Simple**) to retrieve quickly the reply frame for a request frame.

- **getFramesFor**

  This will return an array of possible reply frames for the specified **Net::Frame::Simple** object. For example, reply frames for a UDP probe will be all the frames which have the same source port and destination port as the request.

- **flush**

  Will flush stored frames, the one which have been stored via **store** method.

## SEE ALSO

Net::Frame::Dump

## AUTHOR

Patrice \<GomoR\> Auffret

## COPYRIGHT AND LICENSE

Copyright (c) 2006-2020, Patrice \<GomoR\> Auffret

You may distribute this module under the terms of the Artistic license. See LICENSE.Artistic file in the source distribution archive.