module PcapTools

Public Class Methods

extract_http_calls(stream) click to toggle source
# File lib/pcap_tools.rb, line 100
def extract_http_calls stream
  rebuilded = stream.rebuild_packets
  calls = []
  data_out = ""
  data_in = nil
  k = 0
  while k < rebuilded.size
    begin
      req = HttpParser::parse_request(rebuilded[k])
      resp = k + 1 < rebuilded.size ? HttpParser::parse_response(rebuilded[k + 1]) : nil
      calls << [req, resp]
    rescue Exception => e
      warn "Unable to parse http call : #{e}"
    end
    k += 2
  end
  calls
end
extract_http_calls_from_captures(captures) click to toggle source
# File lib/pcap_tools.rb, line 55
def extract_http_calls_from_captures captures
  calls = []
  extract_tcp_streams(captures).each do |tcp|
    calls.concat(extract_http_calls(tcp))
  end
  calls
end
extract_tcp_streams(captures) click to toggle source
# File lib/pcap_tools.rb, line 65
def extract_tcp_streams captures
  packets = []
  captures.each do |capture|
    capture.each do |packet|
      packets << PacketFu::Packet.parse(packet)
    end
  end

  streams = []
  packets.each_with_index do |packet, k|
    if packet.is_a?(PacketFu::TCPPacket) && packet.tcp_flags.syn == 1 && packet.tcp_flags.ack == 0
      kk = k
      tcp = TcpStream.new
      while kk < packets.size
        packet2 = packets[kk]
        if packet2.is_a?(PacketFu::TCPPacket)
          if packet.tcp_dst == packet2.tcp_dst && packet.tcp_src == packet2.tcp_src
            tcp.insert_tcp :out, packet2
            break if packet.tcp_flags.fin == 1 || packet2.tcp_flags.fin == 1
          end
          if packet.tcp_dst == packet2.tcp_src && packet.tcp_src == packet2.tcp_dst
            tcp.insert_tcp :in, packet2
            break if packet.tcp_flags.fin == 1 || packet2.tcp_flags.fin == 1
          end
        end
        kk += 1
      end
      streams << tcp
    end
  end
  streams
end

Private Instance Methods

extract_http_calls(stream) click to toggle source
# File lib/pcap_tools.rb, line 100
def extract_http_calls stream
  rebuilded = stream.rebuild_packets
  calls = []
  data_out = ""
  data_in = nil
  k = 0
  while k < rebuilded.size
    begin
      req = HttpParser::parse_request(rebuilded[k])
      resp = k + 1 < rebuilded.size ? HttpParser::parse_response(rebuilded[k + 1]) : nil
      calls << [req, resp]
    rescue Exception => e
      warn "Unable to parse http call : #{e}"
    end
    k += 2
  end
  calls
end
extract_http_calls_from_captures(captures) click to toggle source
# File lib/pcap_tools.rb, line 55
def extract_http_calls_from_captures captures
  calls = []
  extract_tcp_streams(captures).each do |tcp|
    calls.concat(extract_http_calls(tcp))
  end
  calls
end
extract_tcp_streams(captures) click to toggle source
# File lib/pcap_tools.rb, line 65
def extract_tcp_streams captures
  packets = []
  captures.each do |capture|
    capture.each do |packet|
      packets << PacketFu::Packet.parse(packet)
    end
  end

  streams = []
  packets.each_with_index do |packet, k|
    if packet.is_a?(PacketFu::TCPPacket) && packet.tcp_flags.syn == 1 && packet.tcp_flags.ack == 0
      kk = k
      tcp = TcpStream.new
      while kk < packets.size
        packet2 = packets[kk]
        if packet2.is_a?(PacketFu::TCPPacket)
          if packet.tcp_dst == packet2.tcp_dst && packet.tcp_src == packet2.tcp_src
            tcp.insert_tcp :out, packet2
            break if packet.tcp_flags.fin == 1 || packet2.tcp_flags.fin == 1
          end
          if packet.tcp_dst == packet2.tcp_src && packet.tcp_src == packet2.tcp_dst
            tcp.insert_tcp :in, packet2
            break if packet.tcp_flags.fin == 1 || packet2.tcp_flags.fin == 1
          end
        end
        kk += 1
      end
      streams << tcp
    end
  end
  streams
end