Class: PacketFu::PcapNG::EPB

Inherits:
Struct
  • Object
show all
Includes:
Block, StructFu
Defined in:
lib/packetfu/pcapng/epb.rb

Overview

Pcapng::EPB represents a Extended Packet Block (EPB) of a pcapng file.

Pcapng::EPB Definition

Int32   :type           Default: 0x00000006
Int32   :block_len
Int32   :interface_id
Int32   :tsh (timestamp high)
Int32   :tsl (timestamp low)
Int32   :cap_len
Int32   :orig_len
String  :data
String  :options
Int32   :block_len2

Constant Summary collapse

MIN_SIZE = 
8*4

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from Block

#pad_field, #recalc_block_len

Methods included from StructFu

#body=, #clone, #set_endianness, #sz, #typecast

Methods inherited from Struct

#force_binary

Constructor Details

#initialize(args = {}) ⇒ EPB

Returns a new instance of EPB.



28
29
30
31
32
33
34
 
# File 'lib/packetfu/pcapng/epb.rb', line 28

def initialize(args={})
  @endian = set_endianness(args[:endian] || :little)
  init_fields(args)
  super(args[:type], args[:block_len], args[:interface_id], args[:tsh],
        args[:tsl], args[:cap_len], args[:orig_len], args[:data],
        args[:options], args[:block_len2])
end

Instance Attribute Details

#block_len ⇒ Object

Returns the value of attribute block_len

Returns:

  • (Object) —

    the current value of block_len



19
20
21
 
# File 'lib/packetfu/pcapng/epb.rb', line 19

def block_len
  @block_len
end

#block_len2 ⇒ Object

Returns the value of attribute block_len2

Returns:

  • (Object) —

    the current value of block_len2



19
20
21
 
# File 'lib/packetfu/pcapng/epb.rb', line 19

def block_len2
  @block_len2
end

#cap_len ⇒ Object

Returns the value of attribute cap_len

Returns:

  • (Object) —

    the current value of cap_len



19
20
21
 
# File 'lib/packetfu/pcapng/epb.rb', line 19

def cap_len
  @cap_len
end

#data ⇒ Object

Returns the value of attribute data

Returns:

  • (Object) —

    the current value of data



19
20
21
 
# File 'lib/packetfu/pcapng/epb.rb', line 19

def data
  @data
end

#endian ⇒ Object

Returns the value of attribute endian.



23
24
25
 
# File 'lib/packetfu/pcapng/epb.rb', line 23

def endian
  @endian
end

#interface ⇒ Object

Returns the value of attribute interface.



24
25
26
 
# File 'lib/packetfu/pcapng/epb.rb', line 24

def interface
  @interface
end

#interface_id ⇒ Object

Returns the value of attribute interface_id

Returns:

  • (Object) —

    the current value of interface_id



19
20
21
 
# File 'lib/packetfu/pcapng/epb.rb', line 19

def interface_id
  @interface_id
end

#options ⇒ Object

Returns the value of attribute options

Returns:

  • (Object) —

    the current value of options



19
20
21
 
# File 'lib/packetfu/pcapng/epb.rb', line 19

def options
  @options
end

#orig_len ⇒ Object

Returns the value of attribute orig_len

Returns:

  • (Object) —

    the current value of orig_len



19
20
21
 
# File 'lib/packetfu/pcapng/epb.rb', line 19

def orig_len
  @orig_len
end

#tsh ⇒ Object

Returns the value of attribute tsh

Returns:

  • (Object) —

    the current value of tsh



19
20
21
 
# File 'lib/packetfu/pcapng/epb.rb', line 19

def tsh
  @tsh
end

#tsl ⇒ Object

Returns the value of attribute tsl

Returns:

  • (Object) —

    the current value of tsl



19
20
21
 
# File 'lib/packetfu/pcapng/epb.rb', line 19

def tsl
  @tsl
end

#type ⇒ Object

Returns the value of attribute type

Returns:

  • (Object) —

    the current value of type



19
20
21
 
# File 'lib/packetfu/pcapng/epb.rb', line 19

def type
  @type
end

Instance Method Details

#has_options? ⇒ Boolean

Returns:

  • (Boolean) 


51
52
53
 
# File 'lib/packetfu/pcapng/epb.rb', line 51

def has_options?
  self[:options].size > 0
end

#init_fields(args = {}) ⇒ Object

Used by #initialize to set the initial fields



37
38
39
40
41
42
43
44
45
46
47
48
49
 
# File 'lib/packetfu/pcapng/epb.rb', line 37

def init_fields(args={})
  args[:type]  = @int32.new(args[:type] || PcapNG::EPB_TYPE.to_i)
  args[:block_len] = @int32.new(args[:block_len] || MIN_SIZE)
  args[:interface_id] = @int32.new(args[:interface_id] || 0)
  args[:tsh] = @int32.new(args[:tsh] || 0)
  args[:tsl] = @int32.new(args[:tsl] || 0)
  args[:cap_len] = @int32.new(args[:cap_len] || 0)
  args[:orig_len] = @int32.new(args[:orig_len] || 0)
  args[:data] = StructFu::String.new(args[:data] || '')
  args[:options] = StructFu::String.new(args[:options] || '')
  args[:block_len2] = @int32.new(args[:block_len2] || MIN_SIZE)
  args
end

#read(str_or_io) ⇒ Object

Reads a String or a IO to populate the object



56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
 
# File 'lib/packetfu/pcapng/epb.rb', line 56

def read(str_or_io)
  if str_or_io.respond_to? :read
    io = str_or_io
  else
    io = StringIO.new(force_binary(str_or_io.to_s))
  end
  return self if io.eof?

  self[:type].read io.read(4)
  self[:block_len].read io.read(4)
  self[:interface_id].read io.read(4)
  self[:tsh].read io.read(4)
  self[:tsl].read io.read(4)
  self[:cap_len].read io.read(4)
  self[:orig_len].read io.read(4)
  self[:data].read io.read(self[:cap_len].to_i)
  data_pad_len = (4 - (self[:cap_len].to_i % 4)) % 4
  io.read data_pad_len
  options_len = self[:block_len].to_i - self[:cap_len].to_i - data_pad_len
  options_len -= MIN_SIZE
  self[:options].read io.read(options_len)
  self[:block_len2].read io.read(4)

  unless self[:block_len].to_i == self[:block_len2].to_i
    raise InvalidFileError, 'Incoherency in Extended Packet Block'
  end

  self
end

#timestamp ⇒ Object

Return timestamp as a Time object



87
88
89
 
# File 'lib/packetfu/pcapng/epb.rb', line 87

def timestamp
  Time.at((self[:tsh].to_i << 32 | self[:tsl].to_i) * ts_resol)
end

#to_s ⇒ Object

Return the object as a String



92
93
94
95
96
 
# File 'lib/packetfu/pcapng/epb.rb', line 92

def to_s
  pad_field :data, :options
  recalc_block_len
  to_a.map(&:to_s).join
end