Do you mean the reserved fields of the TCP/IP4-header?

NetPacket::TCP has already implemented accessors. After decode()-ing the raw packet, you can access the reserved fields by selecting the respective instance data.

Have a look at pack/unpack to further inspect this field.

rspishock:

Study unpack, pack and perlpacktut to see how to disassemble and reassemble binary packets of data, and it will get you most of the way there.

...roboticus

When your only tool is a hammer, all problems look like your thumb.

I don't really have experience with bit operations (in general and in Perl), but I remember a Perl function named vec which may help you.

I think you’re going to have a kernel-level software component to do that, e.g. the privileged interfaces that are tapped by a program such as Ethereal.

Statistical analysis of the thus-recovered data stream probably could be done in-part with Perl.   (I say, “in part,” because Perl’s job would be to extract the bit-sequences for subsequent analysis by established programs such as R.)

Thanks for your advice.

As this is partially just a project for myself, I am also considering using this to help research a paper of forensic detection of network based steganography. My intention is to generate known carrier packets from one test VM and send them to another test VM while collecting them through wireshark. The main part of this is pretty clear, however, the hard part is coming up with the script which I may use.

However, your advice has been helpful, and I'll take a look at R when I get home to see how I can use it.

Thanks again for the advice.