class Unified2::Packet

Packet

Attributes

event_id[R]

Build method defaults

event_timestamp[R]

Build method defaults

length[R]

Build method defaults

microsecond[R]

Build method defaults

packet[R]

Build method defaults

raw[R]

Build method defaults

timestamp[R]

Build method defaults

Public Class Methods

new(packet) click to toggle source

Initialize packet Object

@param [Hash] Packet Packet hash

# File lib/unified2/packet.rb, line 26
def initialize(packet)
  @raw = packet
  @link_type = packet[:linktype]
  @microsecond = packet[:packet_microsecond]

  @event_timestamp = Time.at(packet[:timestamp])
  @timestamp = Time.at(packet[:packet_timestamp])
  @length = packet[:packet_length].to_i
  @event_id = packet[:event_id]

  @packet ||= PacketFu::Packet.parse(packet[:packet])
  @protocol = @packet.protocol.last.to_sym
end

Public Instance Methods

blank?() click to toggle source

Blank?

@return [true, false] Check is payload is blank

# File lib/unified2/packet.rb, line 149
def blank?
  return true unless @packet
  false
end
checksum() click to toggle source

Checksum

Create a unique payload checksum

@return [String] Payload checksum

# File lib/unified2/packet.rb, line 271
def checksum
  Digest::MD5.hexdigest(hex(false))
end
dump(options={}) click to toggle source

Dump

@param [options] options Hash of options for Hexdump#dump

@option options [Integer] :width (16)

The number of bytes to dump for each line.

@option options [Symbol, Integer] :base (:hexadecimal)

The base to print bytes in. Supported bases include, `:hexadecimal`,
`:hex`, `16, `:decimal`, `:dec`, `10, `:octal`, `:oct`, `8`,
`:binary`, `:bin` and `2`.

@option options [Boolean] :ascii (false)

Print ascii characters when possible.

@option options [#<<] :output (STDOUT)

The output to print the hexdump to.

@yield [index,hex_segment,print_segment]

The given block will be passed the hexdump break-down of each segment.

@yieldparam [Integer] index

The index of the hexdumped segment.

@yieldparam [Array<String>] hex_segment

The hexadecimal-byte representation of the segment.

@yieldparam [Array<String>] print_segment

The print-character representation of the segment.

@return [nil]

@raise [ArgumentError]

The given data does not define the `#each_byte` method, or

@note

Please view the hexdump documentation for more
information. Hexdump is a great lib by @postmodern. 
(http://github.com/postmodern/hexdump)
# File lib/unified2/packet.rb, line 237
def dump(options={})
  packet = if options[:header]
             @raw[:packet]
           else
             @packet.payload
           end

  Hexdump.dump(packet, options)
end
eth?() click to toggle source

Ehternet

@return [true,false] Ethernet packet

# File lib/unified2/packet.rb, line 79
def eth?
  @packet.is_eth?
end
Also aliased as: ethernet?
ethernet?()
Alias for: eth?
hex(include_header=true) click to toggle source

Hex

@return [String] Convert payload to hex

# File lib/unified2/packet.rb, line 184
def hex(include_header=true)
  packet = if include_header
             @packet.to_s
           else
             @packet.payload.to_s
           end

  hex = packet.unpack('H*')
  return hex.first if hex
  nil
end
hexdump(options={}) click to toggle source

Hexdump

@see Packet#dump

@example

packet.hexdump(:width => 16)
# File lib/unified2/packet.rb, line 255
def hexdump(options={})
  hexdump = options[:output] ||= ""
  options[:width] ||= 30
  options[:header] ||= true

  dump(options)
  hexdump
end
ip?()
Alias for: ipv4?
ip_header() click to toggle source

IP Header

@return [Hash] IP header

# File lib/unified2/packet.rb, line 45
def ip_header
  if @packet.is_ip?
    ip_header = {
      :ip_ver => @packet.ip_header.ip_v,
      :ip_hlen => @packet.ip_header.ip_hl,
      :ip_tos => @packet.ip_header.ip_tos,
      :ip_len => @packet.ip_header.ip_len,
      :ip_id => @packet.ip_header.ip_id,
      :ip_frag => @packet.ip_header.ip_frag,
      :ip_ttl => @packet.ip_header.ip_ttl,
      :ip_proto => @packet.ip_header.ip_proto,
      :ip_csum => @packet.ip_header.ip_sum
    }
  else
    ip_header = {}
  end

  ip_header
end
ipv4?() click to toggle source

IP Version 4

@return [true,false]

# File lib/unified2/packet.rb, line 89
def ipv4?
  @packet.is_ip?
end
Also aliased as: ip?
ipv6?() click to toggle source

IP Version 6

@return [true,false]

# File lib/unified2/packet.rb, line 99
def ipv6?
  @packet.is_ipv6?
end
payload() click to toggle source

Payload

@return [Payload] Event payload object

# File lib/unified2/packet.rb, line 140
def payload
  @packet.payload
end
protocol() click to toggle source

Protocol

@return [Protocol] packet protocol object

# File lib/unified2/packet.rb, line 108
def protocol
  @proto ||= Protocol.new(@protocol, @packet)
end
to_file(filename, mode) click to toggle source

Output to file

# File lib/unified2/packet.rb, line 131
def to_file(filename, mode)
  @packet.to_f(filename, mode)
end
to_h() click to toggle source
# File lib/unified2/packet.rb, line 163
def to_h
  @to_hash = {
    :event_timestamp => event_timestamp.to_s,
    :timestamp => timestamp.to_s,
    :length => length,
    :microsecond => microsecond,
    :hex => hex,
    :hexdump => hexdump,
    :checksum => checksum,
    :payload => payload,
    :link_type => link_type,
    :protocol => protocol.to_h,
    :ip_header => ip_header
  }
end
to_pcap() click to toggle source

Convert to libpcap format

# File lib/unified2/packet.rb, line 124
def to_pcap
  @packet.to_pcap
end
to_s() click to toggle source

String

@return [String] Signature name

# File lib/unified2/packet.rb, line 117
def to_s
  payload.to_s
end
valid?() click to toggle source

Valid

@return [true,false] Is this a valid packet

# File lib/unified2/packet.rb, line 70
def valid?
  !@packet.is_invalid?
end