### Home Classes Methods

### In Files

- lib/packetfu/pcap.rb

### Parent

Struct.new(:endian, :magic, :ver_major, :ver_minor, :thiszone, :sigfigs, :snaplen, :network)

### Methods

- ::new
- #init_fields
- #read
- #to_s

### Included Modules

- StructFu

### Files

- .document
- README.rdoc

### Class/Module Index

Quicksearch

- PacketFu
- PacketFu::ARPHeader
- PacketFu::ARPHeaderMixin
- PacketFu::ARPPacket
- PacketFu::AddrIpv6
- PacketFu::Capture
- PacketFu::Config
- PacketFu::EthHeader
- PacketFu::EthHeaderMixin
- PacketFu::EthMac
- PacketFu::EthNic
- PacketFu::EthOui
- PacketFu::EthPacket
- PacketFu::HSRPHeader
- PacketFu::HSRPHeaderMixin
- PacketFu::HSRPPacket
- PacketFu::ICMPHeader
- PacketFu::ICMPHeaderMixin
- PacketFu::ICMPPacket
- PacketFu::IPHeader
- PacketFu::IPHeaderMixin
- PacketFu::IPPacket
- PacketFu::IPv6Header
- PacketFu::IPv6HeaderMixin
- PacketFu::IPv6Packet
- PacketFu::Inject
- PacketFu::InvalidHeader
- PacketFu::InvalidPacket
- PacketFu::LLDPHeader
- PacketFu::LLDPHeaderMixin
- PacketFu::LLDPPacket
- PacketFu::Octets
- PacketFu::Packet
- PacketFu::PcapFile
- PacketFu::PcapHeader
- PacketFu::PcapPacket
- PacketFu::PcapPackets
- PacketFu::Read
- PacketFu::TCPHeader
- PacketFu::TCPHeaderMixin
- PacketFu::TCPPacket
- PacketFu::TcpEcn
- PacketFu::TcpFlags
- PacketFu::TcpHlen
- PacketFu::TcpOption
- PacketFu::TcpOption::ECHO
- PacketFu::TcpOption::ECHOREPLY
- PacketFu::TcpOption::EOL
- PacketFu::TcpOption::MSS
- PacketFu::TcpOption::NOP
- PacketFu::TcpOption::SACK
- PacketFu::TcpOption::SACKOK
- PacketFu::TcpOption::TS
- PacketFu::TcpOption::WS
- PacketFu::TcpOptions
- PacketFu::TcpReserved
- PacketFu::Timestamp
- PacketFu::UDPHeader
- PacketFu::UDPHeaderMixin
- PacketFu::UDPPacket
- PacketFu::Utils
- PacketFu::Write
- StructFu
- StructFu::Int
- StructFu::Int16
- StructFu::Int16be
- StructFu::Int16le
- StructFu::Int32
- StructFu::Int32be
- StructFu::Int32le
- StructFu::Int8
- StructFu::IntString
- StructFu::String
- Struct

No matching classes.

# PacketFu::PcapHeader

PcapHeader represents the header portion of a libpcap file (the packets themselves are in the PcapPackets array). See wiki.wireshark.org/Development/LibpcapFileFormat for details.

Depending on the endianness (set with :endian), elements are either :little endian or :big endian.

#### PcapHeader Definition

    Symbol  :endian     Default: :little
    Int32   :magic      Default: 0xa1b2c3d4 # :big is 0xd4c3b2a1
    Int16   :ver_major  Default: 2
    Int16   :ver_minor  Default: 4
    Int32   :thiszone
    Int32   :sigfigs
    Int32   :snaplen    Default: 0xffff
    Int32   :network    Default: 1

### Constants

MAGIC_BIG
MAGIC_INT32
MAGIC_LITTLE

### Public Class Methods

new(args={}) click to toggle source

    # File lib/packetfu/pcap.rb, line 50
    def initialize(args={})
      set_endianness(args[:endian] ||= :little)
      init_fields(args)
      super(args[:endian], args[:magic], args[:ver_major],
            args[:ver_minor], args[:thiszone], args[:sigfigs],
            args[:snaplen], args[:network])
    end

### Public Instance Methods

init_fields(args={}) click to toggle source

Called by initialize to set the initial fields.

    # File lib/packetfu/pcap.rb, line 59
    def init_fields(args={})
      args[:magic] = @int32.new(args[:magic] || PcapHeader::MAGIC_INT32)
      args[:ver_major] = @int16.new(args[:ver_major] || 2)
      args[:ver_minor] ||= @int16.new(args[:ver_minor] || 4)
      args[:thiszone] ||= @int32.new(args[:thiszone])
      args[:sigfigs] ||= @int32.new(args[:sigfigs])
      args[:snaplen] ||= @int32.new(args[:snaplen] || 0xffff)
      args[:network] ||= @int32.new(args[:network] || 1)
      return args
    end

read(str) click to toggle source

Reads a string to populate the object. TODO: Need to test this by getting a hold of a big endian pcap file. Conversion from big to little shouldn't be that big of a deal.

    # File lib/packetfu/pcap.rb, line 78
    def read(str)
      force_binary(str)
      return self if str.nil?
      str.force_encoding(Encoding::BINARY) if str.respond_to? :force_encoding
      if str[0,4] == self[:magic].to_s
        self[:magic].read str[0,4]
        self[:ver_major].read str[4,2]
        self[:ver_minor].read str[6,2]
        self[:thiszone].read str[8,4]
        self[:sigfigs].read str[12,4]
        self[:snaplen].read str[16,4]
        self[:network].read str[20,4]
      else
        raise "Incorrect magic for libpcap"
      end
      self
    end

to_s() click to toggle source

Returns the object in string form.

    # File lib/packetfu/pcap.rb, line 71
    def to_s
      self.to_a[1,7].map {|x| x.to_s}.join
    end

[Validate]

Generated with the Darkfish Rdoc Generator 2.