class PacketFu::PcapPackets

PcapPackets is a collection of PcapPacket objects.

Attributes

endian[RW]

Public Class Methods

new(args={}) click to toggle source
# File lib/packetfu/pcap.rb, line 190
def initialize(args={})
        @endian = args[:endian] || :little
end

Public Instance Methods

force_binary(str) click to toggle source
# File lib/packetfu/pcap.rb, line 194
def force_binary(str)
        str.force_encoding Encoding::BINARY if str.respond_to? :force_encoding
end
read(str) click to toggle source

Reads a string to populate the object. Note, this read takes in the whole pcap file, since we need to see the magic to know what endianness we're dealing with.

# File lib/packetfu/pcap.rb, line 201
def read(str)
        force_binary(str)
        return self if str.nil?
        if str[0,4] == PcapHeader::MAGIC_BIG
                @endian = :big
        elsif str[0,4] == PcapHeader::MAGIC_LITTLE
                @endian = :little
        else
                raise ArgumentError, "Unknown file format for #{self.class}"
        end
        body = str[24,str.size]
        while body.size > 16 # TODO: catch exceptions on malformed packets at end
                p = PcapPacket.new(:endian => @endian)
                p.read(body)
                self<<p
                body = body[p.sz,body.size]
        end
self
end
to_s() click to toggle source
# File lib/packetfu/pcap.rb, line 221
def to_s
        self.join
end