Class: PacketFu::PcapHeader

Inherits:
Struct
  • Object
show all
Includes:
StructFu
Defined in:
lib/packetfu/pcap.rb

Overview

PcapHeader represents the header portion of a libpcap file (the packets themselves are in the PcapPackets array). See wiki.wireshark.org/Development/LibpcapFileFormat for details.

Depending on the endianness (set with :endian), elements are either :little endian or :big endian.

PcapHeader Definition

Symbol  :endian     Default: :little
Int32   :magic      Default: 0xa1b2c3d4 # :big is 0xd4c3b2a1
Int16   :ver_major  Default: 2
Int16   :ver_minor  Default: 4
Int32   :thiszone
Int32   :sigfigs
Int32   :snaplen    Default: 0xffff
Int32   :network    Default: 1

Constant Summary collapse

MAGIC_INT32 =
0xa1b2c3d4
MAGIC_LITTLE =
[MAGIC_INT32].pack("V")
MAGIC_BIG =
[MAGIC_INT32].pack("N")

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from StructFu

#body=, #clone, #set_endianness, #sz, #typecast

Methods inherited from Struct

#force_binary

Constructor Details

#initialize(args = {}) ⇒ PcapHeader

Returns a new instance of PcapHeader


52
53
54
55
56
57
58
# File 'lib/packetfu/pcap.rb', line 52

def initialize(args={})
  set_endianness(args[:endian] ||= :little)
  init_fields(args) 
  super(args[:endian], args[:magic], args[:ver_major], 
        args[:ver_minor], args[:thiszone], args[:sigfigs], 
        args[:snaplen], args[:network])
end

Instance Attribute Details

#endianObject

Returns the value of attribute endian

Returns:

  • (Object)

    the current value of endian


44
45
46
# File 'lib/packetfu/pcap.rb', line 44

def endian
  @endian
end

#magicObject

Returns the value of attribute magic

Returns:

  • (Object)

    the current value of magic


44
45
46
# File 'lib/packetfu/pcap.rb', line 44

def magic
  @magic
end

#networkObject

Returns the value of attribute network

Returns:

  • (Object)

    the current value of network


44
45
46
# File 'lib/packetfu/pcap.rb', line 44

def network
  @network
end

#sigfigsObject

Returns the value of attribute sigfigs

Returns:

  • (Object)

    the current value of sigfigs


44
45
46
# File 'lib/packetfu/pcap.rb', line 44

def sigfigs
  @sigfigs
end

#snaplenObject

Returns the value of attribute snaplen

Returns:

  • (Object)

    the current value of snaplen


44
45
46
# File 'lib/packetfu/pcap.rb', line 44

def snaplen
  @snaplen
end

#thiszoneObject

Returns the value of attribute thiszone

Returns:

  • (Object)

    the current value of thiszone


44
45
46
# File 'lib/packetfu/pcap.rb', line 44

def thiszone
  @thiszone
end

#ver_majorObject

Returns the value of attribute ver_major

Returns:

  • (Object)

    the current value of ver_major


44
45
46
# File 'lib/packetfu/pcap.rb', line 44

def ver_major
  @ver_major
end

#ver_minorObject

Returns the value of attribute ver_minor

Returns:

  • (Object)

    the current value of ver_minor


44
45
46
# File 'lib/packetfu/pcap.rb', line 44

def ver_minor
  @ver_minor
end

Instance Method Details

#init_fields(args = {}) ⇒ Object

Called by initialize to set the initial fields.


61
62
63
64
65
66
67
68
69
70
# File 'lib/packetfu/pcap.rb', line 61

def init_fields(args={})
  args[:magic] = @int32.new(args[:magic] || PcapHeader::MAGIC_INT32)
  args[:ver_major] = @int16.new(args[:ver_major] || 2)
  args[:ver_minor] ||= @int16.new(args[:ver_minor] || 4)
  args[:thiszone] ||= @int32.new(args[:thiszone])
  args[:sigfigs] ||= @int32.new(args[:sigfigs])
  args[:snaplen] ||= @int32.new(args[:snaplen] || 0xffff)
  args[:network] ||= @int32.new(args[:network] || 1)
  return args
end

#read(str) ⇒ Object

Reads a string to populate the object. TODO: Need to test this by getting a hold of a big endian pcap file. Conversion from big to little shouldn't be that big of a deal.


80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
# File 'lib/packetfu/pcap.rb', line 80

def read(str)
  force_binary(str)
  return self if str.nil?
  str.force_encoding(Encoding::BINARY) if str.respond_to? :force_encoding
  if str[0,4] == self[:magic].to_s 
    self[:magic].read str[0,4]
    self[:ver_major].read str[4,2]
    self[:ver_minor].read str[6,2]
    self[:thiszone].read str[8,4]
    self[:sigfigs].read str[12,4]
    self[:snaplen].read str[16,4]
    self[:network].read str[20,4]
  else
    raise "Incorrect magic for libpcap"
  end
  self
end

#to_sObject

Returns the object in string form.


73
74
75
# File 'lib/packetfu/pcap.rb', line 73

def to_s
  self.to_a[1,7].map {|x| x.to_s}.join
end