class PacketFu::PcapHeader
PcapHeader
represents the header portion of a libpcap file (the packets themselves are in the PcapPackets
array). See wiki.wireshark.org/Development/LibpcapFileFormat for details.
Depending on the endianness (set with :endian), elements are either :little endian or :big endian.
PcapHeader
Definition¶ ↑
Symbol :endian Default: :little Int32 :magic Default: 0xa1b2c3d4 # :big is 0xd4c3b2a1 Int16 :ver_major Default: 2 Int16 :ver_minor Default: 4 Int32 :thiszone Int32 :sigfigs Int32 :snaplen Default: 0xffff Int32 :network Default: 1
Constants
- MAGIC_BIG
- MAGIC_INT32
- MAGIC_LITTLE
Public Class Methods
new(args={})
click to toggle source
Calls superclass method
# File lib/packetfu/pcap.rb, line 53 def initialize(args={}) set_endianness(args[:endian] ||= :little) init_fields(args) super(args[:endian], args[:magic], args[:ver_major], args[:ver_minor], args[:thiszone], args[:sigfigs], args[:snaplen], args[:network]) end
Public Instance Methods
init_fields(args={})
click to toggle source
Called by initialize to set the initial fields.
# File lib/packetfu/pcap.rb, line 62 def init_fields(args={}) args[:magic] = @int32.new(args[:magic] || PcapHeader::MAGIC_INT32) args[:ver_major] = @int16.new(args[:ver_major] || 2) args[:ver_minor] ||= @int16.new(args[:ver_minor] || 4) args[:thiszone] ||= @int32.new(args[:thiszone]) args[:sigfigs] ||= @int32.new(args[:sigfigs]) args[:snaplen] ||= @int32.new(args[:snaplen] || 0xffff) args[:network] ||= @int32.new(args[:network] || 1) return args end
read(str)
click to toggle source
Reads a string to populate the object. TODO: Need to test this by getting a hold of a big endian pcap file. Conversion from big to little shouldn’t be that big of a deal.
# File lib/packetfu/pcap.rb, line 81 def read(str) force_binary(str) return self if str.nil? str.force_encoding(Encoding::BINARY) if str.respond_to? :force_encoding if str[0,4] == self[:magic].to_s self[:magic].read str[0,4] self[:ver_major].read str[4,2] self[:ver_minor].read str[6,2] self[:thiszone].read str[8,4] self[:sigfigs].read str[12,4] self[:snaplen].read str[16,4] self[:network].read str[20,4] else raise "Incorrect magic for libpcap" end self end
to_s()
click to toggle source
Returns the object in string form.
# File lib/packetfu/pcap.rb, line 74 def to_s self.to_a[1,7].map {|x| x.to_s}.join end