Adam Kennedy


ThreatNet::Filter::ThreatCache - A Threat Cache implementated as a filter


A ThreatNet::Filter::ThreatCache is a basic filter-based implementation of a Threat Cache, as defined in the ThreatNet concept paper. (

The consistent use of Threat Caches by all nodes is the key to keeping message quantities to a minimum, and allows the entire network to safely run without any canonical state.

As each message is provided to the filter, it stores an IPs that it sees, filtering out any ips that have already been seen in the last hour (or custom period if provided).


new [ $param => $value, ... ]

The new method creates a new Threat Cache object.

It takes a single optional parameter timeout which should the positive integer number of seconds the channel dictates as the mimumum time before an event can be rementioned. The default value is 3600 (1 hour).

Returns a new ThreatNet::Filter::ThreatCache object.

keep $Message

As in the parent ThreatNet::Filter class, the keep method takes as argument a single ThreatNet::Message object.

It returns true if the message can be kept, or false if the message should be dropped.


The synced method checks to see if the Threat Cache has synchronised with the channel.

Returns true if the current time is past the sync time, or false if not.


The stats method returns a hash with a variety of statistics from the Threat Cache.

Returns the stats as a HASH reference.


All bugs should be filed via the bug tracker at

For other issues, or commercial enhancement and support, contact the author


Adam Kennedy <>

SEE ALSO, ThreatNet::Filter


Copyright (c) 2005 Adam Kennedy. All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

The full text of the license can be found in the LICENSE file included with this module.