class FlowTag::PcapParser

Constants

LINKTYPE_ETH
LINKTYPE_SLL

Public Class Methods

new(pcapfh) click to toggle source
# File lib/flowtag/pcapparser.rb, line 21
def initialize(pcapfh)
        @offset = 0
        @bigendian = nil
        @fh = pcapfh
        @fh.seek 0
        magic = @fh.read(4).unpack("N")[0]
        @bigendian = (magic == 0xa1b2c3d4) ? true : false
        endian = (@bigendian) ? "nnNNNN" : "vvVVVV"
        @version_major, @version_minor, @zone, @significant_figures, @snaplength, @linktype = @fh.read(20).unpack(endian)
        @offset += 24
        if @linktype != LINKTYPE_ETH
                puts "Only ethernet is supported, sorry."
                exit
        end
end

Public Instance Methods

close() click to toggle source
# File lib/flowtag/pcapparser.rb, line 53
def close
        @fh.close unless @fh.tty?
end
each() { |nextpkt| ... } click to toggle source
# File lib/flowtag/pcapparser.rb, line 47
def each
        while ! @fh.eof?
                yield nextpkt
        end
end
nextpkt() click to toggle source
# File lib/flowtag/pcapparser.rb, line 37
def nextpkt
        endian = (@bigendian) ? "NNNN" : "VVVV"
        pkt = {}
        tv_sec, tv_usec, caplen, origlen = @fh.read(16).unpack(endian)
        time = tv_sec + (tv_usec / 1E6)
        data = @fh.read(caplen)
        @offset += 16+caplen
        return Packet.new(time, data)
end