Class: FlowTag::PcapParser

Inherits:
Object
  • Object
show all
Defined in:
lib/flowtag/pcapparser.rb

Constant Summary collapse

LINKTYPE_ETH = 
0x0001
LINKTYPE_SLL = 
0x0071

Instance Method Summary collapse

Constructor Details

#initialize(pcapfh) ⇒ PcapParser

Returns a new instance of PcapParser.



21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
 
# File 'lib/flowtag/pcapparser.rb', line 21

def initialize(pcapfh)
	@offset = 0
	@bigendian = nil
	@fh = pcapfh
	@fh.seek 0
	magic = @fh.read(4).unpack("N")[0]
	@bigendian = (magic == 0xa1b2c3d4) ? true : false
	endian = (@bigendian) ? "nnNNNN" : "vvVVVV"
	@version_major, @version_minor, @zone, @significant_figures, @snaplength, @linktype = @fh.read(20).unpack(endian)
	@offset += 24
	if @linktype != LINKTYPE_ETH
		puts "Only ethernet is supported, sorry."
		exit
	end
end

Instance Method Details

#close ⇒ Object 



53
54
55
 
# File 'lib/flowtag/pcapparser.rb', line 53

def close
	@fh.close unless @fh.tty?
end

#each ⇒ Object 



47
48
49
50
51
 
# File 'lib/flowtag/pcapparser.rb', line 47

def each
	while ! @fh.eof?
		yield nextpkt
	end
end

#nextpkt ⇒ Object 



37
38
39
40
41
42
43
44
45
 
# File 'lib/flowtag/pcapparser.rb', line 37

def nextpkt
	endian = (@bigendian) ? "NNNN" : "VVVV"
	pkt = {}
	tv_sec, tv_usec, caplen, origlen = @fh.read(16).unpack(endian)
	time = tv_sec + (tv_usec / 1E6)
	data = @fh.read(caplen)
	@offset += 16+caplen
	return Packet.new(time, data)
end