DIY-pcap 0.2.5 → 0.2.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/bin/pcap +2 -62
- data/bin/rpcap +2 -63
- data/lib/diy/command.rb +80 -0
- data/lib/diy/device_finder.rb +1 -1
- data/lib/diy/dig.rb +3 -1
- data/lib/diy/live.rb +5 -0
- data/lib/diy/parser/mu/fixnum_ext.rb +7 -0
- data/lib/diy/parser/mu/pcap/ethernet.rb +148 -0
- data/lib/diy/parser/mu/pcap/header.rb +75 -0
- data/lib/diy/parser/mu/pcap/io_pair.rb +67 -0
- data/lib/diy/parser/mu/pcap/io_wrapper.rb +76 -0
- data/lib/diy/parser/mu/pcap/ip.rb +61 -0
- data/lib/diy/parser/mu/pcap/ipv4.rb +257 -0
- data/lib/diy/parser/mu/pcap/ipv6.rb +148 -0
- data/lib/diy/parser/mu/pcap/packet.rb +104 -0
- data/lib/diy/parser/mu/pcap/pkthdr.rb +155 -0
- data/lib/diy/parser/mu/pcap/reader.rb +61 -0
- data/lib/diy/parser/mu/pcap/reader/http_family.rb +170 -0
- data/lib/diy/parser/mu/pcap/sctp.rb +367 -0
- data/lib/diy/parser/mu/pcap/sctp/chunk.rb +123 -0
- data/lib/diy/parser/mu/pcap/sctp/chunk/data.rb +134 -0
- data/lib/diy/parser/mu/pcap/sctp/chunk/init.rb +100 -0
- data/lib/diy/parser/mu/pcap/sctp/chunk/init_ack.rb +68 -0
- data/lib/diy/parser/mu/pcap/sctp/parameter.rb +110 -0
- data/lib/diy/parser/mu/pcap/sctp/parameter/ip_address.rb +48 -0
- data/lib/diy/parser/mu/pcap/stream_packetizer.rb +72 -0
- data/lib/diy/parser/mu/pcap/tcp.rb +505 -0
- data/lib/diy/parser/mu/pcap/udp.rb +69 -0
- data/lib/diy/parser/mu/scenario/pcap.rb +172 -0
- data/lib/diy/parser/mu/scenario/pcap/fields.rb +50 -0
- data/lib/diy/parser/mu/scenario/pcap/rtp.rb +71 -0
- data/lib/diy/parser/pcap.rb +113 -0
- data/lib/diy/parser/readme.md +72 -0
- data/lib/diy/utils.rb +9 -1
- data/lib/diy/version.rb +1 -1
- data/lib/diy/worker.rb +3 -2
- data/lib/diy/worker_keeper.rb +6 -0
- data/spec/helper/tcp.dat +0 -0
- data/spec/live_spec.rb +9 -0
- data/spec/mu_parser_spec.rb +12 -0
- data/spec/utils_spec.rb +1 -1
- metadata +34 -3
@@ -0,0 +1,72 @@
|
|
1
|
+
PCAP parser
|
2
|
+
=========
|
3
|
+
|
4
|
+
## 使用方法
|
5
|
+
|
6
|
+
### 解析报文
|
7
|
+
|
8
|
+
|
9
|
+
|
10
|
+
ether = Mu::Pcap::Ethernet.from_bytes pkt_str
|
11
|
+
|
12
|
+
puts ether.payload
|
13
|
+
|
14
|
+
即: 一个报文( 必须是纯字符串 ), 被递归解析, 每个 `payload` 是它上一层的协议类( 比如 `Ethernet`, `IPv4`, `UDP` ), 下面是一些常用的方法:
|
15
|
+
|
16
|
+
* Ethernet
|
17
|
+
|
18
|
+
* `from_bytes(str)`
|
19
|
+
|
20
|
+
解析报文, 并返回特定的类(公共)
|
21
|
+
|
22
|
+
* `to_bytes`
|
23
|
+
|
24
|
+
重新生成报文, 会重新计算checksum(公共)
|
25
|
+
|
26
|
+
* `payload`
|
27
|
+
|
28
|
+
负荷, 通俗叫报文内容, 如果还有被支持的上层协议, 则返回相对应的类. 则已经没有, 则返回真正的负荷.(公共)
|
29
|
+
|
30
|
+
* `src(=)`, `dst(=)`, `type(=)`
|
31
|
+
|
32
|
+
源物理地址, 目的物理地址, 以及上层负载类型( IP, IP6, ARP, PPPOE, 802_1Q )
|
33
|
+
|
34
|
+
|
35
|
+
* IPv4
|
36
|
+
|
37
|
+
* `:ip_id`, `:offset`, `:ttl`, `:proto`, `:src`, `:dst`, `:dscp`
|
38
|
+
|
39
|
+
标志, 段偏移, 生存期, 上层协议(TCP,UDP, SCTP), 源IP, 目的IP, TOS标记
|
40
|
+
|
41
|
+
* v4?
|
42
|
+
|
43
|
+
返回 true
|
44
|
+
|
45
|
+
* fragment?
|
46
|
+
|
47
|
+
检查是否分片
|
48
|
+
|
49
|
+
* IPv6
|
50
|
+
|
51
|
+
* hop_limit
|
52
|
+
|
53
|
+
* next_header
|
54
|
+
|
55
|
+
* TCP
|
56
|
+
|
57
|
+
* `src_port`, `dst_port`, `seq`, `ack`, `flags`, `window`, `urgent`, `mss`, `proto_family`
|
58
|
+
|
59
|
+
不一一说明, `flags` 可以直接与 ( `TH_FIN`, `TH_SYN`, `TH_RST`, `TH_PUSH`, `TH_ACK`, `TH_URG`, `TH_ECE`, `TH_CWR`) 相与(&), 以判断标识.
|
60
|
+
|
61
|
+
* UDP
|
62
|
+
|
63
|
+
* `dst_port`, `src_port`
|
64
|
+
|
65
|
+
更详细的指导, 请查看 `rdoc`:
|
66
|
+
|
67
|
+
在命令行输入 `gem server`, 打开浏览器, 输入 `http://localhost:8808`.
|
68
|
+
|
69
|
+
## Thanks to:
|
70
|
+
Fork from : <https://github.com/mudynamics/pcapr-local/tree/master/lib/mu>
|
71
|
+
|
72
|
+
Thanks to mudynamics, github is <https://github.com/mudynamics>
|
data/lib/diy/utils.rb
CHANGED
@@ -5,7 +5,15 @@ module DIY
|
|
5
5
|
def pp(pkt)
|
6
6
|
pkt = pkt.content if pkt.kind_of?(DIY::Packet)
|
7
7
|
return nil if pkt.nil?
|
8
|
-
( pkt[0..10] + "..." ).dump + "(#{pkt.size} sizes)"
|
8
|
+
#~ ( pkt[0..10] + "..." ).dump + "(#{pkt.size} sizes)"
|
9
|
+
size = pkt.size
|
10
|
+
begin
|
11
|
+
new_pkt = pkt.dup
|
12
|
+
Mu::Pcap::Ethernet.from_bytes(new_pkt).to_s + "(#{size} sizes)"
|
13
|
+
rescue Mu::Pcap::ParseError =>e
|
14
|
+
DIY::Logger.warn "parse error from pkt: " + ( pkt[0..10] + "..." ).dump + "(#{pkt.size} sizes)"
|
15
|
+
return ( pkt[0..10] + "..." ).dump + "(#{pkt.size} sizes)"
|
16
|
+
end
|
9
17
|
end
|
10
18
|
|
11
19
|
def src_mac(pkt)
|
data/lib/diy/version.rb
CHANGED
data/lib/diy/worker.rb
CHANGED
@@ -4,13 +4,14 @@ require 'drb'
|
|
4
4
|
require 'thread'
|
5
5
|
|
6
6
|
module DIY
|
7
|
-
include DRbUndumped
|
8
7
|
class Worker
|
8
|
+
|
9
|
+
include DRbUndumped
|
10
|
+
|
9
11
|
def initialize(live)
|
10
12
|
@live = live
|
11
13
|
@recv_t = nil
|
12
14
|
@start = false
|
13
|
-
@m = Mutex.new
|
14
15
|
@queue = Queue.new
|
15
16
|
loop_recv
|
16
17
|
loop_callback
|
data/lib/diy/worker_keeper.rb
CHANGED
data/spec/helper/tcp.dat
ADDED
Binary file
|
data/spec/live_spec.rb
ADDED
@@ -0,0 +1,12 @@
|
|
1
|
+
require 'spec_helper'
|
2
|
+
|
3
|
+
describe Mu do
|
4
|
+
let(:pkt) { File.open("helper/tcp.dat", "rb") { |f| f.read } }
|
5
|
+
it "#ethernet parse" do
|
6
|
+
eth = Mu::Pcap::Ethernet.from_bytes(pkt)
|
7
|
+
eth.should be_ip
|
8
|
+
ip = eth.payload
|
9
|
+
tcp = ip.payload
|
10
|
+
tcp.should be_kind_of(Mu::Pcap::TCP)
|
11
|
+
end
|
12
|
+
end
|
data/spec/utils_spec.rb
CHANGED
metadata
CHANGED
@@ -5,8 +5,8 @@ version: !ruby/object:Gem::Version
|
|
5
5
|
segments:
|
6
6
|
- 0
|
7
7
|
- 2
|
8
|
-
-
|
9
|
-
version: 0.2.
|
8
|
+
- 6
|
9
|
+
version: 0.2.6
|
10
10
|
platform: ruby
|
11
11
|
authors:
|
12
12
|
- yafei Lee
|
@@ -14,7 +14,7 @@ autorequire:
|
|
14
14
|
bindir: bin
|
15
15
|
cert_chain: []
|
16
16
|
|
17
|
-
date: 2012-10-
|
17
|
+
date: 2012-10-10 00:00:00 +08:00
|
18
18
|
default_executable:
|
19
19
|
dependencies:
|
20
20
|
- !ruby/object:Gem::Dependency
|
@@ -53,6 +53,7 @@ files:
|
|
53
53
|
- bin/rpcap
|
54
54
|
- lib/DIY-pcap.rb
|
55
55
|
- lib/diy/builder.rb
|
56
|
+
- lib/diy/command.rb
|
56
57
|
- lib/diy/controller.rb
|
57
58
|
- lib/diy/device_finder.rb
|
58
59
|
- lib/diy/dig.rb
|
@@ -62,6 +63,33 @@ files:
|
|
62
63
|
- lib/diy/logger.rb
|
63
64
|
- lib/diy/offline.rb
|
64
65
|
- lib/diy/packet.rb
|
66
|
+
- lib/diy/parser/mu/fixnum_ext.rb
|
67
|
+
- lib/diy/parser/mu/pcap/ethernet.rb
|
68
|
+
- lib/diy/parser/mu/pcap/header.rb
|
69
|
+
- lib/diy/parser/mu/pcap/io_pair.rb
|
70
|
+
- lib/diy/parser/mu/pcap/io_wrapper.rb
|
71
|
+
- lib/diy/parser/mu/pcap/ip.rb
|
72
|
+
- lib/diy/parser/mu/pcap/ipv4.rb
|
73
|
+
- lib/diy/parser/mu/pcap/ipv6.rb
|
74
|
+
- lib/diy/parser/mu/pcap/packet.rb
|
75
|
+
- lib/diy/parser/mu/pcap/pkthdr.rb
|
76
|
+
- lib/diy/parser/mu/pcap/reader.rb
|
77
|
+
- lib/diy/parser/mu/pcap/reader/http_family.rb
|
78
|
+
- lib/diy/parser/mu/pcap/sctp.rb
|
79
|
+
- lib/diy/parser/mu/pcap/sctp/chunk.rb
|
80
|
+
- lib/diy/parser/mu/pcap/sctp/chunk/data.rb
|
81
|
+
- lib/diy/parser/mu/pcap/sctp/chunk/init.rb
|
82
|
+
- lib/diy/parser/mu/pcap/sctp/chunk/init_ack.rb
|
83
|
+
- lib/diy/parser/mu/pcap/sctp/parameter.rb
|
84
|
+
- lib/diy/parser/mu/pcap/sctp/parameter/ip_address.rb
|
85
|
+
- lib/diy/parser/mu/pcap/stream_packetizer.rb
|
86
|
+
- lib/diy/parser/mu/pcap/tcp.rb
|
87
|
+
- lib/diy/parser/mu/pcap/udp.rb
|
88
|
+
- lib/diy/parser/mu/scenario/pcap.rb
|
89
|
+
- lib/diy/parser/mu/scenario/pcap/fields.rb
|
90
|
+
- lib/diy/parser/mu/scenario/pcap/rtp.rb
|
91
|
+
- lib/diy/parser/pcap.rb
|
92
|
+
- lib/diy/parser/readme.md
|
65
93
|
- lib/diy/pcap.rb
|
66
94
|
- lib/diy/strategy.rb
|
67
95
|
- lib/diy/strategy_builder.rb
|
@@ -107,7 +135,10 @@ files:
|
|
107
135
|
- spec/helper/pkt4
|
108
136
|
- spec/helper/pkt5
|
109
137
|
- spec/helper/ssh.pcap
|
138
|
+
- spec/helper/tcp.dat
|
139
|
+
- spec/live_spec.rb
|
110
140
|
- spec/logger_spec.rb
|
141
|
+
- spec/mu_parser_spec.rb
|
111
142
|
- spec/offline_spec.rb
|
112
143
|
- spec/spec_helper.rb
|
113
144
|
- spec/utils_spec.rb
|