module ReassembleTcp

Constants

VERSION

Public Class Methods

tcp_connections(filepath) click to toggle source

get TCP connections from pcap file @param [String] filepath pcapfile path @return [Array<ReassembleTcp::TcpConnection>] tcp connections

# File lib/reassemble_tcp.rb, line 12
def self.tcp_connections(filepath)
  streams = []
  PacketFu::PcapFile.read_packets_with_timestamp(filepath) {|pkt|
    next unless pkt.is_ip? and pkt.is_tcp?
    stm = streams.find{|ts| ts.match?(pkt) }
    if pkt.tcp_flags[:syn] == 1 && pkt.tcp_flags[:ack] == 0
      next unless stm.nil?
      streams << TcpConnection.new(pkt)
    else
      next if stm.nil?
      stm << pkt
    end
  }
  streams
end
tcp_data_stream(filepath) { |etime, from, to, data| ... } click to toggle source

get reassembled tcp data @param [String] filepath pcapfile path @yield [time, from, to, data] @yieldparam [Time] time packet timestamp @yieldparam [String] from source IP address @yieldparam [String] to destination IP address @yieldparam [String] data tcp resassembled data

# File lib/reassemble_tcp.rb, line 35
def self.tcp_data_stream(filepath, &block)
  stream_data = {}
  ReassembleTcp.tcp_connections(filepath).each do |conn|
    dst = conn.dst_ip
    src = conn.src_ip
    conn.tcpdata do |range, dir, data|
      next if data.nil? || data.empty?
      from, to = (dir == :send ) ? [src, dst] : [dst, src]
      etime = Time.at(range.last)
      stream_data[etime] = [from, to, data]
    end
  end
  stream_data.keys.sort.each do |etime|
    from, to, data = stream_data[etime]
    yield etime, from, to, data
  end
  nil
end