Class: PacketFu::PcapNG::IDB

Inherits:
Struct
  • Object
show all
Includes:
Block, StructFu
Defined in:
lib/packetfu/pcapng/idb.rb

Overview

Pcapng::IDB represents a Interface Description Block (IDB) of a pcapng file.

Pcapng::IDB Definition

Int32   :type           Default: 0x00000001
Int32   :block_len
Int16   :link_type      Default: 1
Int16   :reserved       Default: 0
Int64   :snaplen        Default: 0 (no limit)
String  :options
Int32   :block_len2

Constant Summary collapse

MIN_SIZE = 
5*4
OPTION_IF_TSRESOL =

Option code for if_tsresol option

9

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from Block

#pad_field, #recalc_block_len

Methods included from StructFu

#body=, #clone, #set_endianness, #sz, #typecast

Methods inherited from Struct

#force_binary

Constructor Details

#initialize(args = {}) ⇒ IDB

Returns a new instance of IDB.



29
30
31
32
33
34
35
36
 
# File 'lib/packetfu/pcapng/idb.rb', line 29

def initialize(args={})
  @endian = set_endianness(args[:endian] || :little)
  @packets = []
  @options_decoded = false
  init_fields(args)
  super(args[:type], args[:block_len], args[:link_type], args[:reserved],
        args[:snaplen], args[:options], args[:block_len2])
end

Instance Attribute Details

#block_len ⇒ Object

Returns the value of attribute block_len

Returns:

  • (Object) —

    the current value of block_len



16
17
18
 
# File 'lib/packetfu/pcapng/idb.rb', line 16

def block_len
  @block_len
end

#block_len2 ⇒ Object

Returns the value of attribute block_len2

Returns:

  • (Object) —

    the current value of block_len2



16
17
18
 
# File 'lib/packetfu/pcapng/idb.rb', line 16

def block_len2
  @block_len2
end

#endian ⇒ Object

Returns the value of attribute endian.



20
21
22
 
# File 'lib/packetfu/pcapng/idb.rb', line 20

def endian
  @endian
end

#link_type ⇒ Object

Returns the value of attribute link_type

Returns:

  • (Object) —

    the current value of link_type



16
17
18
 
# File 'lib/packetfu/pcapng/idb.rb', line 16

def link_type
  @link_type
end

#options ⇒ Object

Returns the value of attribute options

Returns:

  • (Object) —

    the current value of options



16
17
18
 
# File 'lib/packetfu/pcapng/idb.rb', line 16

def options
  @options
end

#packets ⇒ Object

Returns the value of attribute packets.



22
23
24
 
# File 'lib/packetfu/pcapng/idb.rb', line 22

def packets
  @packets
end

#reserved ⇒ Object

Returns the value of attribute reserved

Returns:

  • (Object) —

    the current value of reserved



16
17
18
 
# File 'lib/packetfu/pcapng/idb.rb', line 16

def reserved
  @reserved
end

#section ⇒ Object

Returns the value of attribute section.



21
22
23
 
# File 'lib/packetfu/pcapng/idb.rb', line 21

def section
  @section
end

#snaplen ⇒ Object

Returns the value of attribute snaplen

Returns:

  • (Object) —

    the current value of snaplen



16
17
18
 
# File 'lib/packetfu/pcapng/idb.rb', line 16

def snaplen
  @snaplen
end

#type ⇒ Object

Returns the value of attribute type

Returns:

  • (Object) —

    the current value of type



16
17
18
 
# File 'lib/packetfu/pcapng/idb.rb', line 16

def type
  @type
end

Instance Method Details

#<<(xpb) ⇒ Object

Add a xPB to this section



79
80
81
 
# File 'lib/packetfu/pcapng/idb.rb', line 79

def <<(xpb)
  @packets << xpb
end

#has_options? ⇒ Boolean

Returns:

  • (Boolean) 


50
51
52
 
# File 'lib/packetfu/pcapng/idb.rb', line 50

def has_options?
  self[:options].size > 0
end

#init_fields(args = {}) ⇒ Object

Used by #initialize to set the initial fields



39
40
41
42
43
44
45
46
47
48
 
# File 'lib/packetfu/pcapng/idb.rb', line 39

def init_fields(args={})
  args[:type]  = @int32.new(args[:type] || PcapNG::IDB_TYPE.to_i)
  args[:block_len] = @int32.new(args[:block_len] || MIN_SIZE)
  args[:link_type] = @int16.new(args[:link_type] || 1)
  args[:reserved] = @int16.new(args[:reserved] || 0)
  args[:snaplen] = @int32.new(args[:snaplen] || 0)
  args[:options] = StructFu::String.new(args[:options] || '')
  args[:block_len2] = @int32.new(args[:block_len2] || MIN_SIZE)
  args
end

#read(str_or_io) ⇒ Object

Reads a String or a IO to populate the object



55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
 
# File 'lib/packetfu/pcapng/idb.rb', line 55

def read(str_or_io)
  if str_or_io.respond_to? :read
    io = str_or_io
  else
    io = StringIO.new(force_binary(str_or_io.to_s))
  end
  return self if io.eof?

  self[:type].read io.read(4)
  self[:block_len].read io.read(4)
  self[:link_type].read io.read(2)
  self[:reserved].read io.read(2)
  self[:snaplen].read io.read(4)
  self[:options].read io.read(self[:block_len].to_i - MIN_SIZE)
  self[:block_len2].read io.read(4)

  unless self[:block_len].to_i == self[:block_len2].to_i
    raise InvalidFileError, 'Incoherency in Interface Description Block'
  end

  self
end

#to_s ⇒ Object

Return the object as a String



116
117
118
119
120
 
# File 'lib/packetfu/pcapng/idb.rb', line 116

def to_s
  pad_field :options
  recalc_block_len
  to_a.map(&:to_s).join + @packets.map(&:to_s).join
end

#ts_resol(force = false) ⇒ Object

Give timestamp resolution for this interface



84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
 
# File 'lib/packetfu/pcapng/idb.rb', line 84

def ts_resol(force=false)
  if @options_decoded and not force
    @ts_resol
  else
    packstr = (@endian == :little) ? 'v' : 'n'
    idx = 0
    options = self[:options]
    opt_code = opt_len = 0

    while idx < options.length do
      opt_code, opt_len = options[idx, 4].unpack("#{packstr}2")
      if opt_code == OPTION_IF_TSRESOL and opt_len == 1
        tsresol = options[idx+4, 1].unpack('C').first
        if tsresol & 0x80 == 0
          @ts_resol = 10 ** -tsresol
        else
          @ts_resol = 2 ** -(tsresol & 0x7f)
        end

        @options_decoded = true
        return @ts_resol
      else
        idx += 4 + opt_len
      end
    end

    @options_decoded = true
    @ts_resol = 1E-6  # default value
  end
end