From: Will Drewry <drewry@...>
Date: 2004-08-31T14:11:11+09:00
Subject: Re: How to parse network traffic from tcpdump in ruby?

On Fri, 27 Aug 2004 15:25:35 +0900, Martin Kahlert <mkcon@gmx.de> wrote:
> Hi!
> 
> i have a bunch of network traffic to analyse. The traffic has been
> captured with something like "tcpdump -w traffic -s 0".
> 
> Is there any fast method to parse the traffic file and get the packets'
> headers as well as their payload with relative small effort?
> 
> Of course i would like to do that in ruby, but if there are only perlish
> ways, i will use that, too. The timeframe of the project doesn't allow
> me a lot of try and error.
> 
> Any hints are very appreciated!
> 
> Thanks in advance for any help
> Martin.
> 
> 
here is the pcap package:
 http://www.goto.info.waseda.ac.jp/~fukusima/ruby/pcap-e.html

Here's an example that will print the source addr of every packet in the file:

require 'pcap'
cap = Pcap::Capture.open_offline('/tmp/my.dmp')
cap.each { |pkt| p pkt.src}

Here's  another that will count the total number of SYNs - great for
looking back at synfloods :)

require 'pcap'
cap = Pcap::Capture.open_offline('/tmp/my.dmp')
syn = 0
cap.each { |pkt| syn += 1 if pkt.tcp? and pkt.tcp_syn? }
puts syn

And finally one that might be more what you are interested in! This
one will print out the tcp_data. This is where you start to see the
super convenience of using ruby over ethereal for automagic parsing of
a lot of  dump data :)

require 'pcap'
cap = Pcap::Capture.open_offline('/tmp/my.dmp')
cap.each { |pkt| p pkt.tcp_data if pkt.tcp?  }

I hope that Masaki Fukushima keeps the package alive because it's awesome!

Enjoy! I'd love to see any cooler examples you come up with!
wad