From: William Morgan <wmorgan-ruby-talk@...>
Date: 2004-08-31T05:59:50+09:00
Subject: Re: How to parse network traffic from tcpdump in ruby?

Excerpts (reformatted) from Martin Kahlert's mail of 27 Aug 2004 (EDT):
> For the input side:
> Run a 
> tcpdump -i eth0 -w traffic -s 0 
> on your box while doing some internet surfing.
> 
> For the output side i would like to see something like this:
> Package sent at [timestamp] from [IP-address:port] to [IP-address:port]:
> HTTP/1.1 .....

Frankly, I would run the output through tcpdump again, like this:

  tcpdump -r traffic -vv -A

and then parse the output with some regexps in Ruby. That's the easiest
thing to do.

Alternatively, there is a libpcap-ruby package somewhere that might work
for you. It hasn't been updated in a while and doesn't seem to work for
wireless packets, but it probably works fine for run-of-the-mill
ethernet packets. (The tcpdump solution works fine for dumping wireless
packets if you use -s 0.)

HTH,

-- 
William <wmorgan-ruby-talk@masanjin.net>