Parent

Included Modules

Class/Module Index [+]

Quicksearch

PacketFu::PcapHeader

PcapHeader represents the header portion of a libpcap file (the packets themselves are in the PcapPackets array). See wiki.wireshark.org/Development/LibpcapFileFormat for details.

Depending on the endianness (set with :endian), elements are either :little endian or :big endian.

PcapHeader Definition

Symbol  :endian     Default: :little
Int32   :magic      Default: 0xa1b2c3d4 # :big is 0xd4c3b2a1
Int16   :ver_major  Default: 2
Int16   :ver_minor  Default: 4
Int32   :thiszone
Int32   :sigfigs
Int32   :snaplen    Default: 0xffff
Int32   :network    Default: 1

Public Class Methods

new(args={}) click to toggle source
# File lib/packetfu/pcap.rb, line 51
def initialize(args={})
        set_endianness(args[:endian] ||= :little)
        init_fields(args) 
        super(args[:endian], args[:magic], args[:ver_major], 
                                args[:ver_minor], args[:thiszone], args[:sigfigs], 
                                args[:snaplen], args[:network])
end

Public Instance Methods

init_fields(args={}) click to toggle source

Called by initialize to set the initial fields.

# File lib/packetfu/pcap.rb, line 60
def init_fields(args={})
        args[:magic] = @int32.new(args[:magic] || PcapHeader::MAGIC_INT32)
        args[:ver_major] = @int16.new(args[:ver_major] || 2)
        args[:ver_minor] ||= @int16.new(args[:ver_minor] || 4)
        args[:thiszone] ||= @int32.new(args[:thiszone])
        args[:sigfigs] ||= @int32.new(args[:sigfigs])
        args[:snaplen] ||= @int32.new(args[:snaplen] || 0xffff)
        args[:network] ||= @int32.new(args[:network] || 1)
        return args
end
read(str) click to toggle source

Reads a string to populate the object. TODO: Need to test this by getting a hold of a big endian pcap file. Conversion from big to little shouldn't be that big of a deal.

# File lib/packetfu/pcap.rb, line 79
def read(str)
        force_binary(str)
        return self if str.nil?
        str.force_encoding(Encoding::BINARY) if str.respond_to? :force_encoding
        if str[0,4] == self[:magic].to_s 
                self[:magic].read str[0,4]
                self[:ver_major].read str[4,2]
                self[:ver_minor].read str[6,2]
                self[:thiszone].read str[8,4]
                self[:sigfigs].read str[12,4]
                self[:snaplen].read str[16,4]
                self[:network].read str[20,4]
        else
                raise "Incorrect magic for libpcap"
        end
        self
end
to_s() click to toggle source

Returns the object in string form.

# File lib/packetfu/pcap.rb, line 72
def to_s
        self.to_a[1,7].map {|x| x.to_s}.join
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.