class Mu::Pcap::Packet

Constants

IGNORE_UDP_PORTS

Remove non-L7/DNS/DHCP traffic if there is L7 traffic. Returns original packets if there is no L7 traffic.

Attributes

payload[RW]
payload_raw[RW]

Public Class Methods

isolate_l7(packets) click to toggle source
# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 69
def self.isolate_l7 packets
    cleaned_packets = []
    packets.each do |packet|
        if TCP.tcp? packet
            cleaned_packets << packet
        elsif UDP.udp? packet
            src_port = packet.payload.payload.src_port
            dst_port = packet.payload.payload.dst_port
            if not IGNORE_UDP_PORTS.member? src_port and
                not IGNORE_UDP_PORTS.member? dst_port
                cleaned_packets << packet
            end
        elsif SCTP.sctp? packet
            cleaned_packets << packet
        end
    end
    if cleaned_packets.empty?
        return packets
    end
    return cleaned_packets
end
new() click to toggle source
# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 11
def initialize
    @payload = ''
    @payload_raw = ''
end
normalize(packets) click to toggle source

Reassemble, reorder, and merge packets.

# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 40
def self.normalize packets
    begin
        packets = TCP.reorder packets
    rescue TCP::ReorderError => e
        Pcap.warning e
    end

    begin
        packets = SCTP.reorder packets
    rescue SCTP::ReorderError => e
        Pcap.warning e
    end

    begin
        packets = TCP.merge packets
    rescue TCP::MergeError => e
        Pcap.warning e
    end
    return packets
end

Public Instance Methods

==(other) click to toggle source
# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 98
def == other
    return self.class == other.class && self.payload == other.payload &&
        self.payload_raw == other.payload_raw
end
deepdup() click to toggle source
# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 25
def deepdup
    dup = self.dup
    if @payload.respond_to? :deepdup
        dup.payload = @payload.deepdup
    else
        dup.payload = @payload.dup
    end
    return dup
end
flow_id() click to toggle source
# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 35
def flow_id
    raise NotImplementedError
end
payload_bytes() click to toggle source

Get payload as bytes. If the payload is a parsed object, returns raw payload. Otherwise return unparsed bytes.

# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 18
def payload_bytes
    if @payload.is_a? String
        return @payload
    end
    return @payload_raw
end
to_bytes() click to toggle source
# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 91
def to_bytes
    io = StringIO.new
    write io
    io.close
    return "#{io.string}\0"
end