Module: PacketFu::PcapNG

Defined in:

lib/packetfu/pcapng.rb,
lib/packetfu/pcapng/epb.rb,
lib/packetfu/pcapng/idb.rb,
lib/packetfu/pcapng/shb.rb,
lib/packetfu/pcapng/spb.rb,
lib/packetfu/pcapng/file.rb,
lib/packetfu/pcapng/block.rb,
lib/packetfu/pcapng/unknown_block.rb

Overview

Module to handle PCAP-NG file format. See xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?url=https://raw.githubusercontent.com/pcapng/pcapng/master/draft-tuexen-opsawg-pcapng.xml&modeAsFormat=html/ascii&type=ascii#format_idb

Defined Under Namespace

Modules: Block Classes: EPB, Error, File, IDB, InvalidFileError, SHB, SPB, UnknownBlock

Constant Summary

SHB_TYPE =

Section Header Block type number

StructFu::Int32.new(0x0A0D0D0A, :little)

IDB_TYPE =

Interface Description Block type number

StructFu::Int32.new(1, :little)

SPB_TYPE =

Simple Packet Block type number

StructFu::Int32.new(3, :little)

EPB_TYPE =

Enhanced Packet Block type number

StructFu::Int32.new(6, :little)

LINKTYPE_ETHERNET =

Various LINKTYPE values from www.tcpdump.org/linktypes.html FIXME: only ETHERNET type is defined as this is the only link layer type supported by PacketFu

1