From: David Ross <drossruby@...>
Date: 2004-08-31T20:27:09+09:00
Subject: Re: How to parse network traffic from tcpdump in ruby?


--- Will Drewry <drewry@gmail.com> wrote:

> On Fri, 27 Aug 2004 15:25:35 +0900, Martin Kahlert
> <mkcon@gmx.de> wrote:
> > Hi!
> > 
> > i have a bunch of network traffic to analyse. The
> traffic has been
> > captured with something like "tcpdump -w traffic
> -s 0".
> > 
> > Is there any fast method to parse the traffic file
> and get the packets'
> > headers as well as their payload with relative
> small effort?
> > 
> > Of course i would like to do that in ruby, but if
> there are only perlish
> > ways, i will use that, too. The timeframe of the
> project doesn't allow
> > me a lot of try and error.
> > 
> > Any hints are very appreciated!
> > 
> > Thanks in advance for any help
> > Martin.
> > 
> > 
> here is the pcap package:
> 
>
http://www.goto.info.waseda.ac.jp/~fukusima/ruby/pcap-e.html
> 
> Here's an example that will print the source addr of
> every packet in the file:
> 
> require 'pcap'
> cap = Pcap::Capture.open_offline('/tmp/my.dmp')
> cap.each { |pkt| p pkt.src}
> 
> Here's  another that will count the total number of
> SYNs - great for
> looking back at synfloods :)
> 
> require 'pcap'
> cap = Pcap::Capture.open_offline('/tmp/my.dmp')
> syn = 0
> cap.each { |pkt| syn += 1 if pkt.tcp? and
> pkt.tcp_syn? }
> puts syn
> 
> And finally one that might be more what you are
> interested in! This
> one will print out the tcp_data. This is where you
> start to see the
> super convenience of using ruby over ethereal for
> automagic parsing of
> a lot of  dump data :)
> 
> require 'pcap'
> cap = Pcap::Capture.open_offline('/tmp/my.dmp')
> cap.each { |pkt| p pkt.tcp_data if pkt.tcp?  }
> 
> I hope that Masaki Fukushima keeps the package alive
> because it's awesome!
> 
> Enjoy! I'd love to see any cooler examples you come
> up with!
> wad
> 
> 

Thanks for the examples. Well, if it isn't updated and
it drifts away, someone will maintain it. I use Ruby
very much, and it would be nice to have that library
for use with everyday activities. --David Ross


		
__________________________________
Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo