Parent

Included Modules

Class/Module Index [+]

Quicksearch

PacketFu::PcapPacket

PcapPacket defines how individual packets are stored in a libpcap-formatted file.

Header Definition

Timestamp :timestamp Int32 :incl_len Int32 :orig_len String :data

Public Class Methods

new(args={}) click to toggle source
# File lib/packetfu/pcap.rb, line 149
def initialize(args={})
        set_endianness(args[:endian] ||= :little)
        init_fields(args)
        super(args[:endian], args[:timestamp], args[:incl_len],
                         args[:orig_len], args[:data])
end

Public Instance Methods

init_fields(args={}) click to toggle source

Called by initialize to set the initial fields.

# File lib/packetfu/pcap.rb, line 157
def init_fields(args={})
        args[:timestamp] = Timestamp.new(:endian => args[:endian]).read(args[:timestamp])
        args[:incl_len] = args[:incl_len].nil? ? @int32.new(args[:data].to_s.size) : @int32.new(args[:incl_len])
        args[:orig_len] = @int32.new(args[:orig_len])
        args[:data] = StructFu::String.new.read(args[:data])
end
read(str) click to toggle source

Reads a string to populate the object.

# File lib/packetfu/pcap.rb, line 170
def read(str)
        return unless str
        force_binary(str)
        self[:timestamp].read str[0,8]
        self[:incl_len].read str[8,4]
        self[:orig_len].read str[12,4]
        self[:data].read str[16,self[:incl_len].to_i]
        self
end
to_s() click to toggle source

Returns the object in string form.

# File lib/packetfu/pcap.rb, line 165
def to_s
        self.to_a[1,4].map {|x| x.to_s}.join
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.