class PcapTools::Loader::MyParser

Public Class Methods

new(opts, block) click to toggle source
# File lib/pcap_tools/loader.rb, line 11
def initialize opts, block
  @current_packet_index = 0
  @current_packet = nil
  @current_processing = nil
  @current_proto_name = nil
  @current_field_name = nil
  @block = block
  @opts = opts
end

Public Instance Methods

attr(name, value) click to toggle source
# File lib/pcap_tools/loader.rb, line 21
def attr name, value
  if @current_processing == :proto && name == :name
    @current_proto_name = value
    @current_packet[:protos] << value
  elsif @current_processing == :field && name == :name
    @current_field_name = value
    # p @current_field_name
  elsif name == :show
    if @current_proto_name == "geninfo" && @current_field_name == "timestamp"
      @current_packet[:time] = Time.parse value
    elsif @current_proto_name == "ip" && @current_field_name == "ip.src"
      @current_packet[:from] = value
    elsif @current_proto_name == "ip" && @current_field_name == "ip.dst"
      @current_packet[:to] = value
    elsif @current_proto_name == "tcp" && @current_field_name == "tcp.len"
      @current_packet[:size] = value.to_i
    elsif @current_proto_name == "tcp" && @current_field_name == "tcp.stream"
      @current_packet[:stream] = value.to_i
    elsif @current_proto_name == "tcp" && @current_field_name == "tcp.srcport"
      @current_packet[:from_port] = value.to_i
    elsif @current_proto_name == "tcp" && @current_field_name == "tcp.dstport"
      @current_packet[:to_port] = value.to_i
    elsif @current_proto_name == "tcp" && @current_field_name == "tcp.flags.fin"
      @current_packet[:tcp_flags][:fin] = value == "1"
    elsif @current_proto_name == "tcp" && @current_field_name == "tcp.flags.reset"
      @current_packet[:tcp_flags][:rst] = value == "1"
    elsif @current_proto_name == "tcp" && @current_field_name == "tcp.flags.ack"
      @current_packet[:tcp_flags][:ack] = value == "1"
    elsif @current_proto_name == "tcp" && @current_field_name == "tcp.flags.syn"
      @current_packet[:tcp_flags][:syn] = value == "1"
    elsif @current_proto_name == "tcp" && @current_field_name == "tcp.analysis.retransmission"
      @current_packet[:tcp_retransmission] = true
    elsif @current_proto_name == "tcp" && @current_field_name == "tcp.analysis.lost_segment"
      @current_packet[:tcp_lost_segment] = true
    end
  elsif name == :value
    if @current_proto_name == "fake-field-wrapper" && @current_field_name == "data"
      @current_packet[:data] = [value].pack("H*")
    elsif @current_proto_name == "tcp" && @current_field_name == "tcp.segment_data"
      @current_packet[:data] = [value].pack("H*")
    end
  end
end
end_element(name) click to toggle source
# File lib/pcap_tools/loader.rb, line 84
def end_element name
  if name == :packet
    # p @current_packet
    if @current_packet[:protos].include? "malformed"
      $stderr.puts "Malformed packet #{@current_packet_index}"
      return
    end
    if @current_packet[:tcp_retransmission] && !@opts[:keep_retransmission]
      return
    end
    raise "No data found in packet #{@current_packet_index}, protocols found #{@current_packet[:protos]}" if @current_packet[:data].nil? && @current_packet[:size] > 0
    @current_packet.delete :protos
    @block.call @current_packet_index, @current_packet
    @current_packet_index += 1
  end
end
start_element(name, attrs = []) click to toggle source
# File lib/pcap_tools/loader.rb, line 65
def start_element name, attrs = []
  case name
    when :packet
      @current_packet = {
        :tcp_flags => {},
        :packet_index => @current_packet_index + 1,
        :protos => [],
      }
    when :proto
      @current_processing = :proto
    when :field
      @current_processing = :field
    when :pdml
    else
      raise "Unknown element [#{name}]"
  end
end