Class: Mu::Pcap

Inherits:
Object
  • Object
show all
Defined in:
lib/diy/parser/pcap.rb,
lib/diy/parser/mu/pcap/ip.rb,
lib/diy/parser/mu/pcap/tcp.rb,
lib/diy/parser/mu/pcap/udp.rb,
lib/diy/parser/mu/pcap/ipv4.rb,
lib/diy/parser/mu/pcap/ipv6.rb,
lib/diy/parser/mu/pcap/sctp.rb,
lib/diy/parser/mu/pcap/header.rb,
lib/diy/parser/mu/pcap/packet.rb,
lib/diy/parser/mu/pcap/pkthdr.rb,
lib/diy/parser/mu/pcap/reader.rb,
lib/diy/parser/mu/pcap/io_pair.rb,
lib/diy/parser/mu/pcap/ethernet.rb,
lib/diy/parser/mu/pcap/io_wrapper.rb,
lib/diy/parser/mu/pcap/sctp/chunk.rb,
lib/diy/parser/mu/pcap/sctp/parameter.rb,
lib/diy/parser/mu/pcap/sctp/chunk/data.rb,
lib/diy/parser/mu/pcap/sctp/chunk/init.rb,
lib/diy/parser/mu/pcap/stream_packetizer.rb,
lib/diy/parser/mu/pcap/reader/http_family.rb,
lib/diy/parser/mu/pcap/sctp/chunk/init_ack.rb,
lib/diy/parser/mu/pcap/sctp/parameter/ip_address.rb

Defined Under Namespace

Classes: Ethernet, Header, IOPair, IOWrapper, IP, IPv4, IPv6, Packet, ParseError, Pkthdr, Reader, SCTP, StreamPacketizer, TCP, UDP

Constant Summary collapse

LITTLE_ENDIAN = 
0xd4c3b2a1
BIG_ENDIAN = 
0xa1b2c3d4
DLT_NULL = 
0
DLT_EN10MB = 
1
DLT_RAW =

DLT_LOOP in OpenBSD

12
DLT_LINUX_SLL = 
113

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Pcap

Returns a new instance of Pcap.



26
27
28
29
 
# File 'lib/diy/parser/pcap.rb', line 26

def initialize
    @header = Header.new
    @pkthdrs = []
end

Instance Attribute Details

#header ⇒ Object

Returns the value of attribute header.



24
25
26
 
# File 'lib/diy/parser/pcap.rb', line 24

def header
  @header
end

#pkthdrs ⇒ Object

Returns the value of attribute pkthdrs.



24
25
26
 
# File 'lib/diy/parser/pcap.rb', line 24

def pkthdrs
  @pkthdrs
end

Class Method Details

.assert(cond, msg) ⇒ Object

Assertion used during Pcap parsing



84
85
86
87
88
 
# File 'lib/diy/parser/pcap.rb', line 84

def self.assert cond, msg
    if not cond
        raise ParseError, msg
    end
end

.each_pkthdr(io, decode = true) ⇒ Object

Read PCAP packet headers from IO and return Mu::Pcap::Header. If decode is true, also decode the Pkthdr packet contents to Mu::Pcap objects. Use this for large files when each packet header can processed independently

  • it will perform better.



64
65
66
67
68
69
70
71
72
73
74
 
# File 'lib/diy/parser/pcap.rb', line 64

def self.each_pkthdr io, decode=true
    header = Header.read io
    while not io.eof?
        pkthdr = Pkthdr.read io, header.magic
        if decode
            pkthdr.decode! header.magic, header.linktype
        end
        yield pkthdr
    end
    return header
end

.from_packets(packets) ⇒ Object

Create PCAP from list of packets.



42
43
44
45
46
47
48
49
50
 
# File 'lib/diy/parser/pcap.rb', line 42

def self.from_packets packets
    pcap = Pcap.new
    packets.each do |packet|
        pkthdr = Mu::Pcap::Pkthdr.new
        pkthdr.pkt = packet
        pcap.pkthdrs << pkthdr
    end
    return pcap
end

.read(io, decode = true) ⇒ Object

Read PCAP file from IO and return Mu::Pcap. If decode is true, also decode the Pkthdr packet contents to Mu::Pcap objects.



33
34
35
36
37
38
39
 
# File 'lib/diy/parser/pcap.rb', line 33

def self.read io, decode=true
    pcap = Pcap.new
    pcap.header = each_pkthdr(io, decode) do |pkthdr|
        pcap.pkthdrs << pkthdr
    end
    return pcap
end

.read_packets(io, decode = true) ⇒ Object

Read packets from PCAP



77
78
79
80
81
 
# File 'lib/diy/parser/pcap.rb', line 77

def self.read_packets io, decode=true
    packets = []
    each_pkthdr(io) { |pkthdr| packets << pkthdr.pkt }
    return packets
end

.warning(msg) ⇒ Object

Warnings from Pcap parsing are printed using this method.



91
92
93
 
# File 'lib/diy/parser/pcap.rb', line 91

def self.warning msg
    $stderr.puts "WARNING: #{msg}"
end

Instance Method Details

#==(other) ⇒ Object 



95
96
97
98
99
 
# File 'lib/diy/parser/pcap.rb', line 95

def == other
    return self.class == other.class &&
        self.header   == other.header &&
        self.pkthdrs  == other.pkthdrs
end

#write(io) ⇒ Object

Write PCAP file to IO. Uses big-endian and linktype EN10MB.



53
54
55
56
57
58
 
# File 'lib/diy/parser/pcap.rb', line 53

def write io
    @header.write io
    @pkthdrs.each do |pkthdr|
        pkthdr.write io
    end
end