class PcapTools::Loader::MyParser
Public Class Methods
Source
# File lib/pcap_tools/loader.rb, line 11 def initialize opts, block @current_packet_index = 0 @current_packet = nil @current_processing = nil @current_proto_name = nil @current_field_name = nil @block = block @opts = opts end
Public Instance Methods
Source
# File lib/pcap_tools/loader.rb, line 21 def attr name, value if @current_processing == :proto && name == :name @current_proto_name = value @current_packet[:protos] << value elsif @current_processing == :field && name == :name @current_field_name = value # p @current_field_name elsif name == :show if @current_proto_name == "geninfo" && @current_field_name == "timestamp" @current_packet[:time] = Time.parse value elsif @current_proto_name == "ip" && @current_field_name == "ip.src" @current_packet[:from] = value elsif @current_proto_name == "ip" && @current_field_name == "ip.dst" @current_packet[:to] = value elsif @current_proto_name == "tcp" && @current_field_name == "tcp.len" @current_packet[:size] = value.to_i elsif @current_proto_name == "tcp" && @current_field_name == "tcp.stream" @current_packet[:stream] = value.to_i elsif @current_proto_name == "tcp" && @current_field_name == "tcp.srcport" @current_packet[:from_port] = value.to_i elsif @current_proto_name == "tcp" && @current_field_name == "tcp.dstport" @current_packet[:to_port] = value.to_i elsif @current_proto_name == "tcp" && @current_field_name == "tcp.flags.fin" @current_packet[:tcp_flags][:fin] = value == "1" elsif @current_proto_name == "tcp" && @current_field_name == "tcp.flags.reset" @current_packet[:tcp_flags][:rst] = value == "1" elsif @current_proto_name == "tcp" && @current_field_name == "tcp.flags.ack" @current_packet[:tcp_flags][:ack] = value == "1" elsif @current_proto_name == "tcp" && @current_field_name == "tcp.flags.syn" @current_packet[:tcp_flags][:syn] = value == "1" elsif @current_proto_name == "tcp" && @current_field_name == "tcp.analysis.retransmission" @current_packet[:tcp_retransmission] = true elsif @current_proto_name == "tcp" && @current_field_name == "tcp.analysis.lost_segment" @current_packet[:tcp_lost_segment] = true end elsif name == :value if @current_proto_name == "fake-field-wrapper" && @current_field_name == "data" @current_packet[:data] = [value].pack("H*") elsif @current_proto_name == "tcp" && @current_field_name == "tcp.segment_data" @current_packet[:data] = [value].pack("H*") end end end
Source
# File lib/pcap_tools/loader.rb, line 84 def end_element name if name == :packet # p @current_packet if @current_packet[:protos].include? "malformed" $stderr.puts "Malformed packet #{@current_packet_index}" return end if @current_packet[:tcp_retransmission] && !@opts[:keep_retransmission] return end raise "No data found in packet #{@current_packet_index}, protocols found #{@current_packet[:protos]}" if @current_packet[:data].nil? && @current_packet[:size] > 0 @current_packet.delete :protos @block.call @current_packet_index, @current_packet @current_packet_index += 1 end end
Source
# File lib/pcap_tools/loader.rb, line 65 def start_element name, attrs = [] case name when :packet @current_packet = { :tcp_flags => {}, :packet_index => @current_packet_index + 1, :protos => [], } when :proto @current_processing = :proto when :field @current_processing = :field when :pdml else raise "Unknown element [#{name}]" end end