Class: PacketFu::Read

Inherits:
Object
  • Object
show all
Defined in:
lib/packetfu/pcap.rb

Overview

Read is largely deprecated. It was current in PacketFu 0.2.0, but isn't all that useful in 0.3.0 and beyond. Expect it to go away completely by version 1.0. So, the main use of this class is to learn how to do exactly the same things using the PcapFile object.

Class Method Summary collapse

Class Method Details

.file_to_array(args = {}) ⇒ Object Also known as: f2a

A wrapper for PcapFile#file_to_array, but only returns the array. Actually using the PcapFile object is going to be more useful.

Raises:

  • (ArgumentError)

534
535
536
537
538
# File 'lib/packetfu/pcap.rb', line 534

def file_to_array(args={})
  filename = args[:filename] || args[:file] || args[:out]
  raise ArgumentError, "Need a :filename in string form to read from." if (filename.nil? || filename.class != String)
  PcapFile.new.file_to_array(args)
end

.get_byte_order(pcap_file) ⇒ Object

Reads the magic string of a pcap file, and determines if it's :little or :big endian.


521
522
523
524
# File 'lib/packetfu/pcap.rb', line 521

def get_byte_order(pcap_file)
  byte_order = ((pcap_file[0,4] == PcapHeader::MAGIC_LITTLE) ? :little : :big)
  return byte_order
end

.set_byte_order(byte_order) ⇒ Object

set_byte_order is pretty much totally deprecated.


527
528
529
530
# File 'lib/packetfu/pcap.rb', line 527

def set_byte_order(byte_order)
  PacketFu.instance_variable_set(:@byte_order,byte_order)
  return true
end