From: William Morgan <wmorgan-ruby-talk@...>
Date: 2004-09-02T04:57:13+09:00
Subject: Re: How to parse network traffic from tcpdump in ruby?

Excerpts (reformatted) from Martin Kahlert's mail of 31 Aug 2004 (EDT):
> In article <20040830205945.GG30297@masanjin.net>,
> 	William Morgan <wmorgan-ruby-talk@masanjin.net> writes:
> > Frankly, I would run the output through tcpdump again, like this:
> > 
> >   tcpdump -r traffic -vv -A
> > 
> > and then parse the output with some regexps in Ruby. That's the easiest
> > thing to do.
> 
> Thanks for your response. What is the -A option for?
> My tcpdump version (3.7.2) does not know it.

-A just dumps the packet contents in ASCII form to stdout. This makes it
easy to read things like HTTP requests. You could use -x for hex output
and parse that instead.

I've been playing around with running tcpdump through IO.popen myself
recently and the only problem is that the output is buffered, so I have
to wait for about 20 packets to hit before I get anything from a
readline() call. If that's a problem, use the pcap library instead. (I
just can't use it because it barfs on wireless packets.)

-- 
William <wmorgan-ruby-talk@masanjin.net>