class FFI::PCap::BPFProgram
Structure for ‘pcap_compile()`, `pcap_setfilter()`, etc.
See bpf_program struct in ‘pcap-bpf.h`
Public Class Methods
compile(expr, opts={})
click to toggle source
Compiles a bpf filter without a pcap device being open. Downside is no error messages are available, whereas they are when you use open_dead() and use compile() on the resulting Dead
.
@param [Hash] opts
Additional options for compile
@option opts [optional, DataLink
, Integer, String, Symbol] :datalink
DataLink layer type. The argument type will be resolved to a DataLink value if possible. Defaults to data-link layer type NULL.
@option opts [optional, Integer] :snaplen
The snapshot length for the filter. Defaults to SNAPLEN
@option opts [optional, Integer] :optimize
Optimization flag. 0 means don't optimize. Defaults to 1.
@option opts [optional, Integer] :netmask
A 32-bit number representing the IPv4 netmask of the network on which packets are being captured. It is only used when checking for IPv4 broadcast addresses in the filter program. Default: 0 (unspecified netmask)
@return [BPFProgram]
If no errors occur, a compiled BPFProgram is returned.
# File lib/ffi/pcap/bpf_program.rb, line 69 def self.compile(expr, opts={}) datalink = (opts[:datalink] || 1) dl = datalink.kind_of?(DataLink) ? datalink : DataLink.new(datalink) slen = (opts[:snaplen] || DEFAULT_SNAPLEN) optimize = (opts[:optimize] || 1) mask = (opts[:netmask] || 0) code = new() r = PCap.pcap_compile_nopcap(slen, dl.value, code, expr, optimize, mask) raise(LibError, "pcap_compile_nopcap(): unspecified error") if r < 0 return code end
Public Instance Methods
free!()
click to toggle source
# File lib/ffi/pcap/bpf_program.rb, line 31 def free! unless @closed @freed = true PCap.pcap_freecode(self) end end
freed?()
click to toggle source
# File lib/ffi/pcap/bpf_program.rb, line 38 def freed? @freed == true end
instructions()
click to toggle source
# File lib/ffi/pcap/bpf_program.rb, line 20 def instructions i = 0 sz = BPFInstruction.size Array.new(self.bf_len) do ins = BPFInstruction.new( self[:bf_insn] + i ) i += sz ins end end