I am using Ruby to process some PCAP files. I need to read a complete file and analyze each pcaket.
require 'pcap'
inFile = Pcap::Capture.open_offline("1.pcap")
inFile.loop(-1) do |pkt|
#Process packet.
end
Above code does not exit after reading all the packets. According to the Ruby pcap documentation 'A negative count processes packets forever or until EOF is reached'. What can be t开发者_JAVA技巧he problem here.
I'm using a variation of the below a lot for ad-hoc packet analysis. Works for me. Ruby 1.9.3-p125, pcaprub 0.11.2.
#!/opt/local/bin/ruby1.9
require 'pcaprub'
fn = ARGV[1] || "pcap-000"
pc = Pcap.open_offline(ARGV[0])
pc.each do |pk|
fn1 = fn.succ!
File.binwrite(fn1, pk)
end
精彩评论