class Unified2::Packet
Attributes
Build method defaults
Build method defaults
Build method defaults
Build method defaults
Build method defaults
Build method defaults
Build method defaults
Build method defaults
Public Class Methods
Initialize packet Object
@param [Hash] Packet
Packet
hash
# File lib/unified2/packet.rb, line 26 def initialize(packet) @raw = packet @link_type = packet[:linktype] @microsecond = packet[:packet_microsecond] @event_timestamp = Time.at(packet[:timestamp]) @timestamp = Time.at(packet[:packet_timestamp]) @length = packet[:packet_length].to_i @event_id = packet[:event_id] @packet ||= PacketFu::Packet.parse(packet[:packet]) @protocol = @packet.protocol.last.to_sym end
Public Instance Methods
Blank?
@return [true, false] Check is payload is blank
# File lib/unified2/packet.rb, line 149 def blank? return true unless @packet false end
Checksum
Create a unique payload checksum
@return [String] Payload checksum
# File lib/unified2/packet.rb, line 271 def checksum Digest::MD5.hexdigest(hex(false)) end
Dump
@param [options] options Hash of options for Hexdump#dump
@option options [Integer] :width (16)
The number of bytes to dump for each line.
@option options [Symbol, Integer] :base (:hexadecimal)
The base to print bytes in. Supported bases include, `:hexadecimal`, `:hex`, `16, `:decimal`, `:dec`, `10, `:octal`, `:oct`, `8`, `:binary`, `:bin` and `2`.
@option options [Boolean] :ascii (false)
Print ascii characters when possible.
@option options [#<<] :output (STDOUT)
The output to print the hexdump to.
@yield [index,hex_segment,print_segment]
The given block will be passed the hexdump break-down of each segment.
@yieldparam [Integer] index
The index of the hexdumped segment.
@yieldparam [Array<String>] hex_segment
The hexadecimal-byte representation of the segment.
@yieldparam [Array<String>] print_segment
The print-character representation of the segment.
@return [nil]
@raise [ArgumentError]
The given data does not define the `#each_byte` method, or
@note
Please view the hexdump documentation for more information. Hexdump is a great lib by @postmodern. (http://github.com/postmodern/hexdump)
# File lib/unified2/packet.rb, line 237 def dump(options={}) packet = if options[:header] @raw[:packet] else @packet.payload end Hexdump.dump(packet, options) end
Ehternet
@return [true,false] Ethernet packet
# File lib/unified2/packet.rb, line 79 def eth? @packet.is_eth? end
Hex
@return [String] Convert payload to hex
# File lib/unified2/packet.rb, line 184 def hex(include_header=true) packet = if include_header @packet.to_s else @packet.payload.to_s end hex = packet.unpack('H*') return hex.first if hex nil end
Hexdump
@see Packet#dump
@example
packet.hexdump(:width => 16)
# File lib/unified2/packet.rb, line 255 def hexdump(options={}) hexdump = options[:output] ||= "" options[:width] ||= 30 options[:header] ||= true dump(options) hexdump end
IP Header
@return [Hash] IP header
# File lib/unified2/packet.rb, line 45 def ip_header if @packet.is_ip? ip_header = { :ip_ver => @packet.ip_header.ip_v, :ip_hlen => @packet.ip_header.ip_hl, :ip_tos => @packet.ip_header.ip_tos, :ip_len => @packet.ip_header.ip_len, :ip_id => @packet.ip_header.ip_id, :ip_frag => @packet.ip_header.ip_frag, :ip_ttl => @packet.ip_header.ip_ttl, :ip_proto => @packet.ip_header.ip_proto, :ip_csum => @packet.ip_header.ip_sum } else ip_header = {} end ip_header end
IP Version 4
@return [true,false]
# File lib/unified2/packet.rb, line 89 def ipv4? @packet.is_ip? end
IP Version 6
@return [true,false]
# File lib/unified2/packet.rb, line 99 def ipv6? @packet.is_ipv6? end
Payload
@return [Payload] Event
payload object
# File lib/unified2/packet.rb, line 140 def payload @packet.payload end
@return [Protocol] packet protocol object
# File lib/unified2/packet.rb, line 108 def protocol @proto ||= Protocol.new(@protocol, @packet) end
Output to file
# File lib/unified2/packet.rb, line 131 def to_file(filename, mode) @packet.to_f(filename, mode) end
# File lib/unified2/packet.rb, line 163 def to_h @to_hash = { :event_timestamp => event_timestamp.to_s, :timestamp => timestamp.to_s, :length => length, :microsecond => microsecond, :hex => hex, :hexdump => hexdump, :checksum => checksum, :payload => payload, :link_type => link_type, :protocol => protocol.to_h, :ip_header => ip_header } end
Convert to libpcap format
# File lib/unified2/packet.rb, line 124 def to_pcap @packet.to_pcap end
Valid
@return [true,false] Is this a valid packet
# File lib/unified2/packet.rb, line 70 def valid? !@packet.is_invalid? end