*** Analysis.pm.orig Wed May 12 22:16:54 2010 --- Analysis.pm Wed May 12 22:32:34 2010 *************** *** 62,67 **** --- 62,68 ---- usage() if (grep {/help/} @monitors); my ($target) = pop (@monitors); + my $device = ''; # Autoload TCP, else other protos won't get much to analyse push (@monitors, "TCP") if (! grep {/^TCP/} @monitors); *************** *** 82,87 **** --- 83,93 ---- $args{$k} = $v; } + if ($args{device}) { + $device = $args{device}; + delete $args{device}; + } + my $mod = "Net::Analysis::Listener::$proto"; eval "use $mod"; die "Could not load $mod\n$@\n" if ($@); *************** *** 93,99 **** if ($target =~ / /) { # Assume a filter string, for live capture print "(starting live capture)\n"; ! $el->loop_net (filter => $target); } else { # A file to be loaded die "could not read file '$target'\n" if (! -r $target); --- 99,105 ---- if ($target =~ / /) { # Assume a filter string, for live capture print "(starting live capture)\n"; ! $el->loop_net (filter => $target, device => $device); } else { # A file to be loaded die "could not read file '$target'\n" if (! -r $target); *** Analysis/EventLoop.pm.orig Wed May 12 22:17:08 2010 --- Analysis/EventLoop.pm Wed May 12 22:35:36 2010 *************** *** 52,58 **** sub loop_net { my ($self) = shift; ! my %h = validate (@_, { filter => { type => SCALAR } }); # See 'man Net::Pcap' for more details on these settings. my $promiscuity = 0; --- 52,58 ---- sub loop_net { my ($self) = shift; ! my %h = validate (@_, { filter => { type => SCALAR }, device => { type => SCALAR } }); # See 'man Net::Pcap' for more details on these settings. my $promiscuity = 0; *************** *** 62,68 **** my ($np_err, $net, $mask, $filter_t); ! my $dev = Net::Pcap::lookupdev(\$np_err); Net::Pcap::lookupnet ($dev, \$net, \$mask, \$np_err); my $pcap_t = Net::Pcap::open_live($dev, $snaplen, $promiscuity, --- 62,68 ---- my ($np_err, $net, $mask, $filter_t); ! my $dev = $h{device} ? $h{device} : Net::Pcap::lookupdev(\$np_err); Net::Pcap::lookupnet ($dev, \$net, \$mask, \$np_err); my $pcap_t = Net::Pcap::open_live($dev, $snaplen, $promiscuity,