Class: Mu::Pcap::Packet

Inherits:
Object
  • Object
show all
Defined in:
lib/diy/parser/mu/pcap/packet.rb

Direct Known Subclasses

Ethernet, IP, SCTP, SCTP::Chunk, SCTP::Parameter, TCP, UDP

Constant Summary collapse

IGNORE_UDP_PORTS =

Remove non-L7/DNS/DHCP traffic if there is L7 traffic. Returns original packets if there is no L7 traffic.

[
    53,      # DNS
    67, 68,  # DHCP
    546, 547 # DHCPv6
]

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Packet

Returns a new instance of Packet.



11
12
13
14
 
# File 'lib/diy/parser/mu/pcap/packet.rb', line 11

def initialize
    @payload = ''
    @payload_raw = ''
end

Instance Attribute Details

#payload ⇒ Object

Returns the value of attribute payload.



9
10
11
 
# File 'lib/diy/parser/mu/pcap/packet.rb', line 9

def payload
  @payload
end

#payload_raw ⇒ Object

Returns the value of attribute payload_raw.



9
10
11
 
# File 'lib/diy/parser/mu/pcap/packet.rb', line 9

def payload_raw
  @payload_raw
end

Class Method Details

.isolate_l7(packets) ⇒ Object 



68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
 
# File 'lib/diy/parser/mu/pcap/packet.rb', line 68

def self.isolate_l7 packets
    cleaned_packets = []
    packets.each do |packet|
        if TCP.tcp? packet
            cleaned_packets << packet
        elsif UDP.udp? packet
            src_port = packet.payload.payload.src_port
            dst_port = packet.payload.payload.dst_port
            if not IGNORE_UDP_PORTS.member? src_port and
                not IGNORE_UDP_PORTS.member? dst_port
                cleaned_packets << packet
            end
        elsif SCTP.sctp? packet
            cleaned_packets << packet
        end
    end
    if cleaned_packets.empty?
        return packets
    end
    return cleaned_packets
end

.normalize(packets) ⇒ Object

Reassemble, reorder, and merge packets.



40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
 
# File 'lib/diy/parser/mu/pcap/packet.rb', line 40

def self.normalize packets
    begin
        packets = TCP.reorder packets
    rescue TCP::ReorderError => e
        Pcap.warning e
    end

    begin
        packets = SCTP.reorder packets
    rescue SCTP::ReorderError => e
        Pcap.warning e
    end

    begin
        packets = TCP.merge packets
    rescue TCP::MergeError => e
        Pcap.warning e
    end
    return packets
end

Instance Method Details

#==(other) ⇒ Object 



97
98
99
100
 
# File 'lib/diy/parser/mu/pcap/packet.rb', line 97

def == other
    return self.class == other.class && self.payload == other.payload &&
        self.payload_raw == other.payload_raw
end

#deepdup ⇒ Object 



25
26
27
28
29
30
31
32
33
 
# File 'lib/diy/parser/mu/pcap/packet.rb', line 25

def deepdup
    dup = self.dup
    if @payload.respond_to? :deepdup
        dup.payload = @payload.deepdup
    else
        dup.payload = @payload.dup
    end
    return dup
end

#flow_id ⇒ Object

Raises:

  • (NotImplementedError) 


35
36
37
 
# File 'lib/diy/parser/mu/pcap/packet.rb', line 35

def flow_id
    raise NotImplementedError
end

#payload_bytes ⇒ Object

Get payload as bytes. If the payload is a parsed object, returns raw payload. Otherwise return unparsed bytes.



18
19
20
21
22
23
 
# File 'lib/diy/parser/mu/pcap/packet.rb', line 18

def payload_bytes
    if @payload.is_a? String
        return @payload
    end
    return @payload_raw
end

#to_bytes ⇒ Object 



90
91
92
93
94
95
 
# File 'lib/diy/parser/mu/pcap/packet.rb', line 90

def to_bytes
    io = StringIO.new
    write io
    io.close
    return io.string
end