# File lib/pcap_tools.rb, line 100 def extract_http_calls stream rebuilded = stream.rebuild_packets calls = [] data_out = "" data_in = nil k = 0 while k < rebuilded.size begin req = HttpParser::parse_request(rebuilded[k]) resp = k + 1 < rebuilded.size ? HttpParser::parse_response(rebuilded[k + 1]) : nil calls << [req, resp] rescue Exception => e warn "Unable to parse http call : #{e}" end k += 2 end calls end
# File lib/pcap_tools.rb, line 55 def extract_http_calls_from_captures captures calls = [] extract_tcp_streams(captures).each do |tcp| calls.concat(extract_http_calls(tcp)) end calls end
# File lib/pcap_tools.rb, line 65 def extract_tcp_streams captures packets = [] captures.each do |capture| capture.each do |packet| packets << PacketFu::Packet.parse(packet) end end streams = [] packets.each_with_index do |packet, k| if packet.is_a?(PacketFu::TCPPacket) && packet.tcp_flags.syn == 1 && packet.tcp_flags.ack == 0 kk = k tcp = TcpStream.new while kk < packets.size packet2 = packets[kk] if packet2.is_a?(PacketFu::TCPPacket) if packet.tcp_dst == packet2.tcp_dst && packet.tcp_src == packet2.tcp_src tcp.insert_tcp :out, packet2 break if packet.tcp_flags.fin == 1 || packet2.tcp_flags.fin == 1 end if packet.tcp_dst == packet2.tcp_src && packet.tcp_src == packet2.tcp_dst tcp.insert_tcp :in, packet2 break if packet.tcp_flags.fin == 1 || packet2.tcp_flags.fin == 1 end end kk += 1 end streams << tcp end end streams end
# File lib/pcap_tools.rb, line 100 def extract_http_calls stream rebuilded = stream.rebuild_packets calls = [] data_out = "" data_in = nil k = 0 while k < rebuilded.size begin req = HttpParser::parse_request(rebuilded[k]) resp = k + 1 < rebuilded.size ? HttpParser::parse_response(rebuilded[k + 1]) : nil calls << [req, resp] rescue Exception => e warn "Unable to parse http call : #{e}" end k += 2 end calls end
# File lib/pcap_tools.rb, line 55 def extract_http_calls_from_captures captures calls = [] extract_tcp_streams(captures).each do |tcp| calls.concat(extract_http_calls(tcp)) end calls end
# File lib/pcap_tools.rb, line 65 def extract_tcp_streams captures packets = [] captures.each do |capture| capture.each do |packet| packets << PacketFu::Packet.parse(packet) end end streams = [] packets.each_with_index do |packet, k| if packet.is_a?(PacketFu::TCPPacket) && packet.tcp_flags.syn == 1 && packet.tcp_flags.ack == 0 kk = k tcp = TcpStream.new while kk < packets.size packet2 = packets[kk] if packet2.is_a?(PacketFu::TCPPacket) if packet.tcp_dst == packet2.tcp_dst && packet.tcp_src == packet2.tcp_src tcp.insert_tcp :out, packet2 break if packet.tcp_flags.fin == 1 || packet2.tcp_flags.fin == 1 end if packet.tcp_dst == packet2.tcp_src && packet.tcp_src == packet2.tcp_dst tcp.insert_tcp :in, packet2 break if packet.tcp_flags.fin == 1 || packet2.tcp_flags.fin == 1 end end kk += 1 end streams << tcp end end streams end