Net::Inspect::L5::GuessProtocol(3p)

NAME
Net::Inspect::L5::GuessProtocol - tries to find and redirect to appropriate protocol handler

SYNOPSIS
 ...
 my $guess = Net::Inspect::L5::GuessProtocol->new;
 $guess->attach($http);
 $guess->attach($null);
 ...
 my $tcp = Net::Inspect::L4::TCP->new($guess);

DESCRIPTION
Uses the attached flows to find out, which OSI Layer 7 protocol the data might be in and then gives control to the appropriate protocol handler.

Implements the hooks required for "Net::Inspect::L4::TCP". Usually attached to "Net::Inspect::L4::TCP" and attached flows are usually "Net::Inspect::Connection::*".

Methods:

attach(flow)
    attaches specified flow, which should provide "guess_protocol" method

detach(flow)
    detaches specified flow

attached
    returns list of attached flows

Hooks provided:

new_connection(\%meta)
in($dir,$data,$eof,$time)
    forwarded to protocol implementing object if it is already found. Otherwise calls "guess_protocol" and length($data).

fatal($reason,$time)
    forwarded to protocol implementing object

Called hooks:

guess_protocol($guess,$dir,$data,$eof,$time,\%meta)
    The flow should return an appropriate Net::Inspect::Connection object if it does implement the protocol. If it does not implement the protocol it should detach itself from the $guess flow using "$guess->detach($self)" and return (). If it needs more data to decide it should simply return ().

    The hook must do it's own buffering of the given data and process them before returning itself as the protocol handler.

The hooks "in" and "fatal" gets forwarded to the protocol implementing object once it is found.