class Mu::Pcap::Packet
Constants
- IGNORE_UDP_PORTS
Remove non-L7/DNS/DHCP traffic if there is L7 traffic. Returns original packets if there is no L7 traffic.
Attributes
payload[RW]
payload_raw[RW]
Public Class Methods
isolate_l7(packets)
click to toggle source
# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 69 def self.isolate_l7 packets cleaned_packets = [] packets.each do |packet| if TCP.tcp? packet cleaned_packets << packet elsif UDP.udp? packet src_port = packet.payload.payload.src_port dst_port = packet.payload.payload.dst_port if not IGNORE_UDP_PORTS.member? src_port and not IGNORE_UDP_PORTS.member? dst_port cleaned_packets << packet end elsif SCTP.sctp? packet cleaned_packets << packet end end if cleaned_packets.empty? return packets end return cleaned_packets end
new()
click to toggle source
# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 11 def initialize @payload = '' @payload_raw = '' end
normalize(packets)
click to toggle source
Reassemble, reorder, and merge packets.
# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 40 def self.normalize packets begin packets = TCP.reorder packets rescue TCP::ReorderError => e Pcap.warning e end begin packets = SCTP.reorder packets rescue SCTP::ReorderError => e Pcap.warning e end begin packets = TCP.merge packets rescue TCP::MergeError => e Pcap.warning e end return packets end
Public Instance Methods
==(other)
click to toggle source
# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 98 def == other return self.class == other.class && self.payload == other.payload && self.payload_raw == other.payload_raw end
deepdup()
click to toggle source
# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 25 def deepdup dup = self.dup if @payload.respond_to? :deepdup dup.payload = @payload.deepdup else dup.payload = @payload.dup end return dup end
flow_id()
click to toggle source
# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 35 def flow_id raise NotImplementedError end
payload_bytes()
click to toggle source
Get payload as bytes. If the payload is a parsed object, returns raw payload. Otherwise return unparsed bytes.
# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 18 def payload_bytes if @payload.is_a? String return @payload end return @payload_raw end
to_bytes()
click to toggle source
# File lib/woolen_common/pcap/mu/pcap/packet.rb, line 91 def to_bytes io = StringIO.new write io io.close return "#{io.string}\0" end