class Mu::Pcap

Constants

BIG_ENDIAN
DLT_EN10MB
DLT_LINUX_SLL
DLT_NULL
DLT_RAW
LITTLE_ENDIAN

Attributes

header[RW]
pkthdrs[RW]

Public Class Methods

assert(cond, msg) click to toggle source

Assertion used during Pcap parsing

# File lib/woolen_common/pcap/pcap.rb, line 85
def self.assert cond, msg
    if not cond
        raise ParseError, msg
    end
end
each_pkthdr(io, decode=true) { |pkthdr| ... } click to toggle source

Read PCAP packet headers from IO and return Mu::Pcap::Header. If decode is true, also decode the Pkthdr packet contents to Mu::Pcap objects. Use this for large files when each packet header can processed independently

  • it will perform better.

# File lib/woolen_common/pcap/pcap.rb, line 65
def self.each_pkthdr io, decode=true
    header = Header.read io
    while not io.eof?
        pkthdr = Pkthdr.read io, header.magic
        if decode
            pkthdr.decode! header.magic, header.linktype
        end
        yield pkthdr
    end
    return header
end
from_packets(packets) click to toggle source

Create PCAP from list of packets.

# File lib/woolen_common/pcap/pcap.rb, line 43
def self.from_packets packets
    pcap = Pcap.new
    packets.each do |packet|
        pkthdr = Mu::Pcap::Pkthdr.new
        pkthdr.pkt = packet
        pcap.pkthdrs << pkthdr
    end
    return pcap
end
new() click to toggle source
# File lib/woolen_common/pcap/pcap.rb, line 27
def initialize
    @header = Header.new
    @pkthdrs = []
end
read(io, decode=true) click to toggle source

Read PCAP file from IO and return Mu::Pcap. If decode is true, also decode the Pkthdr packet contents to Mu::Pcap objects.

# File lib/woolen_common/pcap/pcap.rb, line 34
def self.read io, decode=true
    pcap = Pcap.new
    pcap.header = each_pkthdr(io, decode) do |pkthdr|
        pcap.pkthdrs << pkthdr
    end
    return pcap
end
read_packets(io, decode=true) click to toggle source

Read packets from PCAP

# File lib/woolen_common/pcap/pcap.rb, line 78
def self.read_packets io, decode=true
    packets = []
    each_pkthdr(io) { |pkthdr| packets << pkthdr.pkt }
    return packets
end
warning(msg) click to toggle source

Warnings from Pcap parsing are printed using this method.

# File lib/woolen_common/pcap/pcap.rb, line 92
def self.warning msg
    $stderr.puts "WARNING: #{msg}"
end

Public Instance Methods

==(other) click to toggle source
# File lib/woolen_common/pcap/pcap.rb, line 96
def == other
    return self.class == other.class &&
        self.header == other.header &&
        self.pkthdrs == other.pkthdrs
end
write(io) click to toggle source

Write PCAP file to IO. Uses big-endian and linktype EN10MB.

# File lib/woolen_common/pcap/pcap.rb, line 54
def write io
    @header.write io
    @pkthdrs.each do |pkthdr|
        pkthdr.write io
    end
end