class Spcap::Stream

Constants

MagicNumber

File format : File header

4 Magic number
2,2  Major version       Minor version
4  Time zone offset always set to 0
4  Time stamp accuracy always set to 0
4  Snapshot length
4  Link-layer header type

Public Class Methods

new(istream) click to toggle source
# File lib/spcap/stream.rb, line 14
def initialize(istream)
  @istream = istream
  @magic_number = read(4)
  if @magic_number == MagicNumber
    @unpack_16 = "n"
    @unpack_32 = "N"
  else
    @unpack_16 = "v"
    @unpack_32 = "V"
  end
  @major_version, @minor_version = read16, read16
  read(8) # flush unused  time_zone_offset_always_0, timestamp_accuracy_always_0,
  @snapshot_length = read32
  @linklayer_header_type = read32
  # if header type is not ethernet raise an error !!
  raise InitializeException, "Not PCAP ethernet stream is not supported"if @linklayer_header_type != 1
  
end

Public Instance Methods

close() click to toggle source
# File lib/spcap/stream.rb, line 32
def close
  @istream.close
end
each() { |p| ... } click to toggle source
Packets header

4 Time stamp, seconds value 4 Time stamp, microseconds value 4 Length of captured packet data 4 Un-truncated length of the packet data

# File lib/spcap/stream.rb, line 54
def each
  until(@istream.eof?)
    p = self.next
    yield p unless p.nil?
  end
end
eof?() click to toggle source
# File lib/spcap/stream.rb, line 61
def eof? ; @istream.eof? ; end
next() click to toggle source
# File lib/spcap/stream.rb, line 63
def next
  time = Time.at(read32,read32)
  caplen = read32
  len = read32
  # TODO : move Ethernet parsing in Packet class constructor
  src_mac_address = read(6)
  dst_mac_address = read(6)
  protocol_type = read(2).unpack("n").first
  raw_data = read(caplen-14)
  if protocol_type == 0x0800
    p = Factory.get_packet(time,raw_data,len,@linklayer_header_type)
    if p.nil?
      Logger.warn "Spcap::Factory return nil packet"
    else
      return p
    end
  else
    # ignore non IPv4 packets
    Logger.info "Non-IPv4 packets are ignored Protocol = #{protocol_type}"
  end
  return nil      
end
read(size) click to toggle source
# File lib/spcap/stream.rb, line 35
def read(size)
  buf = @istream.read(size)
  return buf
end
read16() click to toggle source
# File lib/spcap/stream.rb, line 40
def read16 
  buf = read(2)
  buf.unpack(@unpack_16).first
end
read32() click to toggle source
# File lib/spcap/stream.rb, line 45
def read32 
  buf = read(4)
  buf.unpack(@unpack_32).first
end