开发者

Ruby PCAP Reading a complete capture file

开发者 https://www.devze.com 2023-02-08 15:43 出处:网络
I am using Ruby to process some PCAP files. I need to read a complete file and analyze each pcaket. require \'pcap\'

I am using Ruby to process some PCAP files. I need to read a complete file and analyze each pcaket.

require 'pcap'

inFile = Pcap::Capture.open_offline("1.pcap")

inFile.loop(-1) do |pkt|
#Process packet.
end

Above code does not exit after reading all the packets. According to the Ruby pcap documentation 'A negative count processes packets forever or until EOF is reached'. What can be t开发者_JAVA技巧he problem here.


I'm using a variation of the below a lot for ad-hoc packet analysis. Works for me. Ruby 1.9.3-p125, pcaprub 0.11.2.

#!/opt/local/bin/ruby1.9
require 'pcaprub'

fn = ARGV[1] || "pcap-000"
pc = Pcap.open_offline(ARGV[0])
pc.each do |pk|
  fn1 = fn.succ!
  File.binwrite(fn1, pk)
end
0

精彩评论

暂无评论...
验证码 换一张
取 消

关注公众号