pcap_simple 0.2.0

data/.document

@@ -0,0 +1,5 @@
+lib/**/*.rb
+bin/*
+- 
+features/**/*.feature
+LICENSE.txt

data/.rspec

@@ -0,0 +1 @@
+--color

data/Gemfile

@@ -0,0 +1,14 @@
+source "http://rubygems.org"
+# Add dependencies required to use your gem here.
+# Example:
+#   gem "activesupport", ">= 2.3.5"
+
+# Add dependencies to develop your gem here.
+# Include everything needed to run rake, tests, features, etc.
+group :development do
+  gem "rspec", "~> 2.3.0"
+  gem "bundler", "~> 1.0.0"
+  gem "jeweler", "~> 1.5.2"
+  gem "rcov", ">= 0"
+  gem "bit-struct", "~> 0.13.6"
+end

data/LICENSE.txt

@@ -0,0 +1,20 @@
+Copyright (c) 2011 Ryan Breed
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.rdoc

@@ -0,0 +1,19 @@
+= pcap_simple
+
+Basic pcap file reader. API is gawky.
+
+== Contributing to pcap_simple
+ 
+* Check out the latest master to make sure the feature hasn't been implemented or the bug hasn't been fixed yet
+* Check out the issue tracker to make sure someone already hasn't requested it and/or contributed it
+* Fork the project
+* Start a feature/bugfix branch
+* Commit and push until you are happy with your contribution
+* Make sure to add tests for it. This is important so I don't break it in a future version unintentionally.
+* Please try not to mess with the Rakefile, version, or history. If you want to have your own version, or is otherwise necessary, that is fine, but please isolate to its own commit so I can cherry-pick around it.
+
+== Copyright
+
+Copyright (c) 2011 Ryan Breed. See LICENSE.txt for
+further details.
+

data/Rakefile

@@ -0,0 +1,47 @@
+require 'rubygems'
+require 'bundler'
+begin
+  Bundler.setup(:default, :development)
+rescue Bundler::BundlerError => e
+  $stderr.puts e.message
+  $stderr.puts "Run `bundle install` to install missing gems"
+  exit e.status_code
+end
+require 'rake'
+
+require 'jeweler'
+Jeweler::Tasks.new do |gem|
+  gem.name = "pcap_simple"
+  gem.homepage = "http://github.com/ryanbreed/pcap_simple"
+  gem.license = "MIT"
+  gem.summary = %Q{ Simplified pcap file reader }
+  gem.description = %Q{ A pure ruby BitStruct implementation of a pcap file reader}
+  gem.email = "opensource@breed.org"
+  gem.authors = ["Ryan Breed"]
+  gem.add_runtime_dependency 'bit-struct', '~> 0.13.6'
+  gem.add_development_dependency 'rspec', '~> 2.3.0'
+end
+Jeweler::RubygemsDotOrgTasks.new
+
+require 'rspec/core'
+require 'rspec/core/rake_task'
+RSpec::Core::RakeTask.new(:spec) do |spec|
+  spec.pattern = FileList['spec/**/*_spec.rb']
+end
+
+RSpec::Core::RakeTask.new(:rcov) do |spec|
+  spec.pattern = 'spec/**/*_spec.rb'
+  spec.rcov = true
+end
+
+task :default => :spec
+
+require 'rake/rdoctask'
+Rake::RDocTask.new do |rdoc|
+  version = File.exist?('VERSION') ? File.read('VERSION') : ""
+
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title = "pcap_simple #{version}"
+  rdoc.rdoc_files.include('README*')
+  rdoc.rdoc_files.include('lib/**/*.rb')
+end

data/VERSION

@@ -0,0 +1 @@
+0.2.0

data/lib/pcap_simple.rb

@@ -0,0 +1,126 @@
+# DATE: Feb 9, 2011
+# CREATED BY RYAN BREED
+#
+require 'rubygems'
+require 'bit-struct'
+
+module PcapSimple
+  PCAP_HEADER_LEN=   ((5*32 + 2*16)/8)
+  PACKET_HEADER_LEN= ((4*32)/8)
+  VERSION=File.read(File.join(File.expand_path(File.dirname(__FILE__)),'..','VERSION'))
+
+  class PcapFile
+    attr_accessor :file_name
+    attr_reader   :file, :header
+    include Enumerable
+    def initialize(*args)
+      Hash[*args].each {|k,v| self.send("%s="%k,v)}
+      raise ArgumentError, "need to specify file_name" if file_name.nil?
+      @file=File.open(file_name,"r")
+      @header=PcapHeader.new(file.read(PCAP_HEADER_LEN))
+    end
+    def each(&block)
+      file.seek(PCAP_HEADER_LEN)
+      loop do
+        header_data=file.read(PACKET_HEADER_LEN)
+        break if (header_data.nil? || header_data.length < PACKET_HEADER_LEN)
+        header=PcapRecord.new(header_data)
+        raw=file.read(header.incl_len)
+        break if (raw.nil? || raw.length < header.incl_len)
+        packet=Packet.new(:raw_data=>raw,:header=>header)
+
+        yield packet unless packet.datagram.nil?
+      end
+    end
+  end
+  class Packet
+    attr_accessor :raw_data, :header
+    attr_reader   :ethernet, :ip, :datagram
+    
+    def initialize(*args)
+      Hash[*args].each {|k,v| self.send("%s="%k,v)}
+      raise ArgumentError, "need to specify raw_data" if raw_data.nil?
+      @ethernet=Ethernet.new(raw_data)
+      @ip      =IP.new(@ethernet.data)
+      case ip.ip_p
+        when 17
+          @datagram=UDP.new(ip.data)
+      end
+    end
+    def udp_data
+      datagram.data
+    end
+    def src
+      ip.ip_src
+    end
+    def dst
+      ip.ip_dst
+    end
+    def ip_id
+      ip.ip_id
+    end
+    def sport
+      datagram.sport
+    end
+    def dport
+      datagram.dport
+    end
+    def time
+      Time.at(header.ts_sec)
+    end
+  end
+  class PcapHeader < BitStruct
+    default_options :endian=>:native
+    unsigned  :magic_number,  32, "Magic Number"
+    unsigned  :version_major, 16, "Major Version Number"
+    unsigned  :version_minor, 16, "Minor Version Number"
+    signed    :thiszone,      32, "GMT to local offset"
+    unsigned  :sigfigs,       32, "Timestamp Accuracy"
+    unsigned  :snaplen,       32, "max octets per captured packet"
+    unsigned  :network,       32, "Datalink Capture Type"
+  end
+
+  class PcapRecord < BitStruct
+    default_options :endian=>:native
+    unsigned  :ts_sec,    32,     "Timestamp Seconds"
+    unsigned  :ts_usec,   32,     "Timestamp Microseconds"
+    unsigned  :incl_len,  32,     "Octets included in file"
+    unsigned  :orig_len,  32,     "Octets in original packet"
+  end
+
+  class Ethernet < BitStruct
+    hex_octets :mac_dst,  48,     "Source MAC"
+    hex_octets :mac_src,  48,     "Destination MAC"
+    unsigned   :ethertype,16,     "Ethertype or length"
+    rest       :data
+  end
+
+  class IP < BitStruct
+    unsigned    :ip_v,     4,     "Version"
+    unsigned    :ip_hl,    4,     "Header length"
+    unsigned    :ip_tos,   8,     "TOS"
+    unsigned    :ip_len,  16,     "Length"
+    unsigned    :ip_id,   16,     "ID"
+    unsigned    :ip_off,  16,     "Frag offset"
+    unsigned    :ip_ttl,   8,     "TTL"
+    unsigned    :ip_p,     8,     "Protocol"
+    unsigned    :ip_sum,  16,     "Checksum"
+    octets      :ip_src,  32,     "Source addr"
+    octets      :ip_dst,  32,     "Dest addr"
+    rest        :data,        "Body of message"
+
+    note "     rest is application defined message body"
+
+    initial_value.ip_v    = 4
+    initial_value.ip_hl   = 5
+  end
+
+  class UDP < BitStruct
+    unsigned    :sport,   16,     "Source Port"
+    unsigned    :dport,   16,     "Destination Port"
+    unsigned    :length,  16,     "Datagram Length"
+    unsigned    :checksum,16,     "Datagram Checksum"
+    rest        :data,            "UDP Data"
+  end
+
+end

data/spec/pcap_simple_spec.rb

@@ -0,0 +1,7 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+describe "PcapSimple" do
+  it "wins" do
+    true
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,12 @@
+$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
+$LOAD_PATH.unshift(File.dirname(__FILE__))
+require 'rspec'
+require 'pcap_simple'
+
+# Requires supporting files with custom matchers and macros, etc,
+# in ./support/ and its subdirectories.
+Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each {|f| require f}
+
+RSpec.configure do |config|
+  
+end

metadata

@@ -0,0 +1,187 @@
+--- !ruby/object:Gem::Specification 
+name: pcap_simple
+version: !ruby/object:Gem::Version 
+  hash: 23
+  prerelease: 
+  segments: 
+  - 0
+  - 2
+  - 0
+  version: 0.2.0
+platform: ruby
+authors: 
+- Ryan Breed
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2011-02-20 00:00:00 -06:00
+default_executable: 
+dependencies: 
+- !ruby/object:Gem::Dependency 
+  name: rspec
+  version_requirements: &id001 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 2
+        - 3
+        - 0
+        version: 2.3.0
+  prerelease: false
+  type: :development
+  requirement: *id001
+- !ruby/object:Gem::Dependency 
+  name: bundler
+  version_requirements: &id002 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 23
+        segments: 
+        - 1
+        - 0
+        - 0
+        version: 1.0.0
+  prerelease: false
+  type: :development
+  requirement: *id002
+- !ruby/object:Gem::Dependency 
+  name: jeweler
+  version_requirements: &id003 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 7
+        segments: 
+        - 1
+        - 5
+        - 2
+        version: 1.5.2
+  prerelease: false
+  type: :development
+  requirement: *id003
+- !ruby/object:Gem::Dependency 
+  name: rcov
+  version_requirements: &id004 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 0
+        version: "0"
+  prerelease: false
+  type: :development
+  requirement: *id004
+- !ruby/object:Gem::Dependency 
+  name: bit-struct
+  version_requirements: &id005 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 39
+        segments: 
+        - 0
+        - 13
+        - 6
+        version: 0.13.6
+  prerelease: false
+  type: :development
+  requirement: *id005
+- !ruby/object:Gem::Dependency 
+  name: bit-struct
+  version_requirements: &id006 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 39
+        segments: 
+        - 0
+        - 13
+        - 6
+        version: 0.13.6
+  prerelease: false
+  type: :runtime
+  requirement: *id006
+- !ruby/object:Gem::Dependency 
+  name: rspec
+  version_requirements: &id007 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 2
+        - 3
+        - 0
+        version: 2.3.0
+  prerelease: false
+  type: :development
+  requirement: *id007
+description: " A pure ruby BitStruct implementation of a pcap file reader"
+email: opensource@breed.org
+executables: []
+
+extensions: []
+
+extra_rdoc_files: 
+- LICENSE.txt
+- README.rdoc
+files: 
+- .document
+- .rspec
+- Gemfile
+- LICENSE.txt
+- README.rdoc
+- Rakefile
+- VERSION
+- lib/pcap_simple.rb
+- spec/pcap_simple_spec.rb
+- spec/spec_helper.rb
+has_rdoc: true
+homepage: http://github.com/ryanbreed/pcap_simple
+licenses: 
+- MIT
+post_install_message: 
+rdoc_options: []
+
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
+requirements: []
+
+rubyforge_project: 
+rubygems_version: 1.5.2
+signing_key: 
+specification_version: 3
+summary: Simplified pcap file reader
+test_files: 
+- spec/pcap_simple_spec.rb
+- spec/spec_helper.rb