Module: PacketFu

Defined in:
lib/packetfu.rb,
lib/packetfu/pcap.rb,
lib/packetfu/pcap.rb,
lib/packetfu/pcap.rb,
lib/packetfu/utils.rb,
lib/packetfu/config.rb,
lib/packetfu/inject.rb,
lib/packetfu/packet.rb,
lib/packetfu/capture.rb,
lib/packetfu/version.rb,
lib/packetfu/protos/ip.rb,
lib/packetfu/protos/arp.rb,
lib/packetfu/protos/eth.rb,
lib/packetfu/protos/tcp.rb,
lib/packetfu/protos/tcp.rb,
lib/packetfu/protos/tcp.rb,
lib/packetfu/protos/udp.rb,
lib/packetfu/protos/hsrp.rb,
lib/packetfu/protos/icmp.rb,
lib/packetfu/protos/ipv6.rb,
lib/packetfu/protos/invalid.rb

Defined Under Namespace

Classes: ARPHeader, ARPPacket, AddrIpv6, Capture, Config, EthHeader, EthMac, EthNic, EthOui, EthPacket, HSRPHeader, HSRPPacket, ICMPHeader, ICMPPacket, IPHeader, IPPacket, IPv6Header, IPv6Packet, Inject, InvalidHeader, InvalidPacket, Octets, Packet, PcapFile, PcapHeader, PcapPacket, PcapPackets, Read, TCPHeader, TCPPacket, TcpEcn, TcpFlags, TcpHlen, TcpOption, TcpOptions, TcpReserved, Timestamp, UDPHeader, UDPPacket, Utils, Write

Constant Summary collapse

VERSION =

Check the repo’s for version release histories

"1.1.3"

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.add_packet_class(klass) ⇒ Object

Adds the class to PacketFu’s list of packet classes – used in packet parsing.



72
73
74
75
76
77
78
79
80
 
# File 'lib/packetfu.rb', line 72

def self.add_packet_class(klass)
	raise "Need a class" unless klass.kind_of? Class
	if klass.name !~ /[A-Za-z0-9]Packet/
		raise "Packet classes should be named 'ProtoPacket'"
	end
	@packet_classes ||= []
	@packet_classes << klass
	@packet_classes.sort! {|x,y| x.name <=> y.name}
end

.at_least?(str) ⇒ Boolean

Returns true if the version is equal to or greater than the compare version. If the current version of PacketFu is “0.3.1” for example:

PacketFu.at_least? "0"     # => true 
PacketFu.at_least? "0.2.9" # => true 
PacketFu.at_least? "0.3"   # => true 
PacketFu.at_least? "1"     # => true after 1.0's release
PacketFu.at_least? "1.12"  # => false
PacketFu.at_least? "2"     # => false

Returns:

  • (Boolean) 


30
31
32
33
34
 
# File 'lib/packetfu/version.rb', line 30

def self.at_least?(str)
	this_version = binarize_version(self.version)
	ask_version = binarize_version(str)
	this_version >= ask_version
end

.binarize_version(str) ⇒ Object

Returns a version string in a binary format for easy comparisons.



12
13
14
15
16
17
18
19
 
# File 'lib/packetfu/version.rb', line 12

def self.binarize_version(str)
	if(str.respond_to?(:split) && str =~ /^[0-9]+(\.([0-9]+)(\.[0-9]+)?)?\..+$/)
		bin_major,bin_minor,bin_teeny = str.split(/\x2e/).map {|x| x.to_i}
		bin_version = (bin_major.to_i << 16) + (bin_minor.to_i << 8) + bin_teeny.to_i
	else
		raise ArgumentError, "Compare version malformed. Should be \x22x.y.z\x22"
	end
end

.classes ⇒ Object

Returns an array of classes defined in PacketFu



67
68
69
 
# File 'lib/packetfu.rb', line 67

def self.classes
	constants.map { |const| const_get(const) if const_get(const).kind_of? Class}.compact
end

.force_binary(str) ⇒ Object

Deal with Ruby’s encoding by ignoring it.



29
30
31
 
# File 'lib/packetfu.rb', line 29

def self.force_binary(str)
	str.force_encoding "binary" if str.respond_to? :force_encoding
end

.inspect_style ⇒ Object

The current inspect style. One of :hex, :dissect, or :default Note that :default means Ruby’s default, which is usually far too long to be useful.



104
105
106
 
# File 'lib/packetfu.rb', line 104

def self.inspect_style
	@inspect_style ||= :dissect
end

.inspect_style=(arg) ⇒ Object

Setter for PacketFu’s @inspect_style



109
110
111
112
113
114
115
116
117
118
119
120
 
# File 'lib/packetfu.rb', line 109

def self.inspect_style=(arg)
	@inspect_style = case arg
		when :hex, :pretty
			:hex
		when :dissect, :verbose
			:dissect
		when :default, :ugly
			:default
		else
			:dissect
		end
end

.newer_than?(str) ⇒ Boolean

Returns true if the current version is newer than the compare version.

Returns:

  • (Boolean) 


45
46
47
48
 
# File 'lib/packetfu/version.rb', line 45

def self.newer_than?(str)
	return false if str == self.version
	!self.older_than?(str)
end

.older_than?(str) ⇒ Boolean

Returns true if the current version is older than the compare version.

Returns:

  • (Boolean) 


37
38
39
40
41
42
 
# File 'lib/packetfu/version.rb', line 37

def self.older_than?(str)
	return false if str == self.version
	this_version = binarize_version(self.version)
	ask_version = binarize_version(str)
	this_version < ask_version
end

.packet_classes ⇒ Object

Returns an array of packet classes



91
92
93
 
# File 'lib/packetfu.rb', line 91

def self.packet_classes
	@packet_classes || []
end

.packet_prefixes ⇒ Object

Returns an array of packet types by packet prefix.



96
97
98
99
 
# File 'lib/packetfu.rb', line 96

def self.packet_prefixes
	return [] unless @packet_classes
	@packet_classes.map {|p| p.to_s.split("::").last.to_s.downcase.gsub(/packet$/,"")}
end

.pcaprub_loaded? ⇒ Boolean

Returns the status of pcaprub

Returns:

  • (Boolean) 


62
63
64
 
# File 'lib/packetfu.rb', line 62

def self.pcaprub_loaded?
	@pcaprub_loaded
end

.pcaprub_platform_require ⇒ Object

PacketFu works best with Pcaprub version 0.8-dev (at least) The current (Aug 01, 2010) pcaprub gem is 0.9, so should be fine.



41
42
43
44
45
46
47
48
 
# File 'lib/packetfu.rb', line 41

def self.pcaprub_platform_require
	begin
		require 'pcaprub'
	rescue LoadError
		return false
	end
	@pcaprub_loaded = true 
end

.remove_packet_class(klass) ⇒ Object

Presumably, there may be a time where you’d like to remove a packet class.



83
84
85
86
87
88
 
# File 'lib/packetfu.rb', line 83

def self.remove_packet_class(klass)
	raise "Need a class" unless klass.kind_of? Class
	@packet_classes ||= []
	@packet_classes.delete klass
	@packet_classes 
end

.require_protos(cwd) ⇒ Object

Picks up all the protocols defined in the protos subdirectory



16
17
18
19
20
21
22
23
24
25
26
 
# File 'lib/packetfu.rb', line 16

def self.require_protos(cwd)
	protos_dir = File.join(cwd, "packetfu", "protos")
	Dir.new(protos_dir).each do |fname|
		next unless fname[/\.rb$/]
		begin 
			require File.join(protos_dir,fname)
		rescue
			warn "Warning: Could not load `#{fname}'. Skipping."
		end
	end
end

.version ⇒ Object

Returns PacketFu::VERSION



7
8
9
 
# File 'lib/packetfu/version.rb', line 7

def self.version
	VERSION
end

Instance Method Details

#toggle_inspect ⇒ Object

Switches inspect styles in a round-robin fashion between :dissect, :default, and :hex



124
125
126
127
128
129
130
131
132
133
134
135
 
# File 'lib/packetfu.rb', line 124

def toggle_inspect
	case @inspect_style
	when :hex, :pretty
		@inspect_style = :dissect
	when :dissect, :verbose
		@inspect_style = :default
	when :default, :ugly
		@inspect_style = :hex
	else
		@inspect_style = :dissect
	end
end