class Mu::Pcap
Constants
- BIG_ENDIAN
- DLT_EN10MB
- DLT_LINUX_SLL
- DLT_NULL
- DLT_RAW
- LITTLE_ENDIAN
Attributes
header[RW]
pkthdrs[RW]
Public Class Methods
assert(cond, msg)
click to toggle source
Assertion used during Pcap
parsing
# File lib/woolen_common/pcap/pcap.rb, line 85 def self.assert cond, msg if not cond raise ParseError, msg end end
each_pkthdr(io, decode=true) { |pkthdr| ... }
click to toggle source
Read PCAP packet headers from IO and return Mu::Pcap::Header
. If decode is true, also decode the Pkthdr
packet contents to Mu::Pcap
objects. Use this for large files when each packet header can processed independently
-
it will perform better.
# File lib/woolen_common/pcap/pcap.rb, line 65 def self.each_pkthdr io, decode=true header = Header.read io while not io.eof? pkthdr = Pkthdr.read io, header.magic if decode pkthdr.decode! header.magic, header.linktype end yield pkthdr end return header end
from_packets(packets)
click to toggle source
Create PCAP from list of packets.
# File lib/woolen_common/pcap/pcap.rb, line 43 def self.from_packets packets pcap = Pcap.new packets.each do |packet| pkthdr = Mu::Pcap::Pkthdr.new pkthdr.pkt = packet pcap.pkthdrs << pkthdr end return pcap end
new()
click to toggle source
# File lib/woolen_common/pcap/pcap.rb, line 27 def initialize @header = Header.new @pkthdrs = [] end
read(io, decode=true)
click to toggle source
Read PCAP file from IO and return Mu::Pcap
. If decode is true, also decode the Pkthdr
packet contents to Mu::Pcap
objects.
# File lib/woolen_common/pcap/pcap.rb, line 34 def self.read io, decode=true pcap = Pcap.new pcap.header = each_pkthdr(io, decode) do |pkthdr| pcap.pkthdrs << pkthdr end return pcap end
read_packets(io, decode=true)
click to toggle source
Read packets from PCAP
# File lib/woolen_common/pcap/pcap.rb, line 78 def self.read_packets io, decode=true packets = [] each_pkthdr(io) { |pkthdr| packets << pkthdr.pkt } return packets end
warning(msg)
click to toggle source
Warnings from Pcap
parsing are printed using this method.
# File lib/woolen_common/pcap/pcap.rb, line 92 def self.warning msg $stderr.puts "WARNING: #{msg}" end
Public Instance Methods
==(other)
click to toggle source
# File lib/woolen_common/pcap/pcap.rb, line 96 def == other return self.class == other.class && self.header == other.header && self.pkthdrs == other.pkthdrs end
write(io)
click to toggle source
Write PCAP file to IO. Uses big-endian and linktype EN10MB.
# File lib/woolen_common/pcap/pcap.rb, line 54 def write io @header.write io @pkthdrs.each do |pkthdr| pkthdr.write io end end