redhound 1.0.1 → 2.0.0.rc2

data/lib/redhound/filter/program.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+module Redhound
+  # @api private
+  module Filter
+    # @api private
+    class Program
+      KernelPacket = Struct.new(:data, :original_length, :meta)
+      attr_reader :instructions # : Array[[Integer, Integer, Integer, Integer]]
+      attr_reader :linktype # : Integer?
+
+      # @rbs (Array[[Integer, Integer, Integer, Integer]] instructions, ?linktype: Integer?, ?cooked_live: bool) -> void
+      def initialize(instructions, linktype: nil, cooked_live: false)
+        BPF::Validator.validate!(instructions)
+        @instructions = instructions.map { |instruction| instruction.dup.freeze }.freeze
+        @linktype = linktype
+        @cooked_live = cooked_live
+        @vm = BPF::VM.new(@instructions)
+      end
+
+      # @rbs (untyped packet) -> Integer
+      def evaluate(packet)
+        return 0 if linktype && packet.linktype != linktype
+
+        if @cooked_live
+          return 0 if packet.data.bytesize < 20
+          protocol = packet.data.unpack1('n')
+          packet = KernelPacket.new(packet.data.byteslice(20..), packet.original_length - 20, packet.meta.merge(protocol: protocol))
+        end
+        @vm.evaluate(packet)
+      end
+
+      # @rbs (untyped packet) -> bool
+      def match?(packet) = evaluate(packet).positive?
+
+      # Native struct sock_filter / struct bpf_insn bytes.
+      # @rbs () -> String
+      def packed = instructions.map { |instruction| instruction.pack('SCCL') }.join
+
+      alias serialize packed
+      alias to_binary packed
+
+      # @rbs (?format: Symbol) -> String
+      def disassemble(format: :text) = BPF::Disassembler.disassemble(instructions, format: format)
+
+      # Includes a String reference retained by pack('P') until setsockopt/ioctl finishes.
+      # @rbs () -> String
+      def sock_fprog
+        pointer_size = [nil].pack('P').bytesize
+        [instructions.size, packed].pack("S x#{pointer_size - 2} P")
+      end
+    end
+  end
+end

data/lib/redhound/filter.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+require_relative 'errors'
+require_relative 'filter/bpf/validator'
+require_relative 'filter/bpf/vm'
+require_relative 'filter/bpf/disassembler'
+require_relative 'filter/program'
+require_relative 'filter/lexer'
+require_relative 'filter/parser'
+require_relative 'filter/analyzer'
+require_relative 'filter/bpf/assembler'
+require_relative 'filter/codegen'
+
+module Redhound
+  # @api private
+  module Filter
+    # Compiles a pcap-filter subset without libpcap or external commands.
+    # @rbs (String expression, ?linktype: Symbol | Integer, ?snaplen: Integer, ?live: bool) -> Program
+    def self.compile(expression, linktype: :ethernet, snaplen: 262_144, live: false)
+      raise ArgumentError, 'filter expression must be a String' unless expression.is_a?(String)
+      raise ArgumentError, 'snaplen must be between 1 and 16777216' unless snaplen.between?(1, 16_777_216)
+      type = linktype.is_a?(Integer) ? linktype : CodeGen::LINKTYPES.fetch(linktype) { raise FilterError, "unknown linktype #{linktype}" }
+      ast = Analyzer.new(expression).analyze(Parser.new(expression).parse)
+      CodeGen.new(type, snaplen, live, expression).compile(ast)
+    rescue SystemStackError
+      raise FilterTooLarge, 'filter expression is too deeply nested'
+    end
+  end
+end

data/lib/redhound/layer.rb

@@ -0,0 +1,75 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # One decoded protocol header and its payload bounds, fields and diagnostics.
+  class Layer
+    # Protocol identity, captured offset, decoded values and diagnostics.
+    attr_reader :protocol, :offset, :diagnostics, :definitions, :values, :embedded
+    # Header size and absolute payload bounds used by child dissectors.
+    attr_accessor :header_length, :payload_offset, :payload_end
+
+    # @rbs (Symbol protocol, Integer offset, Integer length, Integer limit, ?definitions: Array[untyped], ?values: Hash[Symbol, untyped], ?embedded: bool) -> void
+    # Create a bounded header with optional fixed field definitions and values.
+    def initialize(protocol, offset, length, limit, definitions: [], values: {}, embedded: false)
+      @protocol, @offset, @header_length = protocol, offset, length
+      @payload_offset, @payload_end = offset + length, limit
+      @definitions, @values, @embedded = definitions, values, embedded
+      @diagnostics = [] # @rbs Array[untyped]
+    end
+
+    # @rbs (Symbol key) -> untyped
+    # Read the raw value identified by a symbolic field key.
+    def [](key) = @values[key]
+    # @rbs () -> Integer
+    # Decoded header length in bytes.
+    def length = @header_length
+    # @rbs () -> bool
+    # Whether no bytes remain for a child protocol.
+    def payload_empty? = @payload_offset >= @payload_end
+    # @rbs () -> bool
+    # Whether an error or truncation stops the protocol chain.
+    def error? = @diagnostics.any? { |d| d.severity == :error || d.code == :truncated }
+
+    # @rbs (Symbol severity, Symbol code, ?String message, ?String? field) -> Layer
+    # Append a structured diagnostic and return this layer.
+    def diagnose(severity, code, message = code.to_s, field = nil)
+      @diagnostics << Diagnostic.new(severity, code, message, field)
+      self
+    end
+
+    # @rbs (Symbol key, String name, untyped value, ?type: Symbol, ?offset: Integer, ?length: Integer, ?format: Symbol?, ?enum: untyped) -> Layer
+    # Append a dynamic field with its value, representation and location.
+    def add(key, name, value, type: :uint, offset: 0, length: 0, format: nil, enum: nil)
+      @values[key] = value
+      @definitions << FieldDefinition.new(key, name, type, offset, length, 0, nil, nil, 1, format, enum)
+      self
+    end
+
+    # @rbs () -> Array[Field]
+    # Return Field objects for all fixed and dynamic definitions.
+    def fields = @definitions.map { |d| Field.new(d, @values[d.key], @offset) }
+    # @rbs (Symbol key) -> String
+    # Return escaped text for a single symbolic field.
+    def display(key)
+      definition = @definitions.find { |d| d.key == key }
+      definition ? Field.new(definition, @values[key], @offset).display : ''
+    end
+    # @rbs (String name) -> untyped
+    # Read the first decoded value with this dotted field name.
+    def field_value(name)
+      definition = @definitions.find { |d| d.name == name }
+      definition ? Field.new(definition, @values[definition.key], @offset).value : nil
+    end
+    # @rbs (String name) -> Array[untyped]
+    # Read the first decoded value with this dotted field name.
+    def field_values(name) = fields.select { |f| f.name == name }.map(&:value)
+
+    # @rbs () -> Hash[Symbol, untyped]
+    # Return JSON fields, grouping repeated names into arrays.
+    def to_h
+      { protocol: @protocol, offset: @offset, length: length, embedded: @embedded,
+        fields: fields.group_by(&:name).to_h { |name, group| [name, group.length == 1 ? group.first.json_value : group.map(&:json_value)] } }
+    end
+  end
+end

data/lib/redhound/output/fields.rb

@@ -0,0 +1,20 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Output
+    # @api private
+    class Fields
+      # @rbs (Array[String] names) -> void
+      def initialize(names) = @names = names
+      # @rbs (Packet packet, untyped io) -> void
+      def format(packet, io)
+        cells = @names.map do |name|
+          packet.layers.flat_map(&:fields).select { |f| f.name == name }.map(&:display).join(',')
+        end
+        io.write(cells.join("\t") + "\n")
+      end
+    end
+  end
+end

data/lib/redhound/output/follow.rb

@@ -0,0 +1,64 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+require 'tempfile'
+
+module Redhound
+  # @api private
+  module Output
+    # @api private
+    class Follow
+      # @rbs (String specification) -> void
+      def initialize(specification)
+        match = /\Atcp,(ascii|hex|raw),(\d+)\z/.match(specification)
+        raise ConfigurationError, 'follow must be tcp,ascii|hex|raw,N' unless match
+        @format, @stream_id, @offsets = match[1], match[2].to_i, [0, 0]
+        @file = Tempfile.new(['redhound-follow-', '.bin'])
+        @file.binmode
+        @key = nil # @rbs untyped
+      end
+      # @rbs (Analysis::Flow flow, Integer direction, String data) -> void
+      def write(flow, direction, data)
+        return unless flow.id == @stream_id && !data.empty?
+        @key ||= flow.key
+        @file.write([direction, data.bytesize].pack('CN'))
+        @file.write(data)
+      end
+      # @rbs (untyped io) -> void
+      def format(io)
+        @file.rewind
+        unless @format == 'raw'
+          io.puts("TCP stream #{@stream_id} (#{@format})")
+          if @key
+            io.puts("Node 0: #{@key[1]}:#{@key[2]}")
+            io.puts("Node 1: #{@key[3]}:#{@key[4]}")
+          end
+        end
+        while (header = @file.read(5))
+          direction, length = header.unpack('CN')
+          data = @file.read(length) #: String
+          case @format
+          when 'raw' then io.write(data)
+          when 'ascii'
+            io.write(direction.zero? ? '' : "\t")
+            io.write(data.gsub(/[^\x20-\x7e\r\n\t]/n) { |byte| Kernel.format('\\x%02x', byte.getbyte(0)) })
+          when 'hex'
+            data.bytes.each_slice(16) do |bytes|
+              io.puts(Kernel.format('%s%08x  %s', direction.zero? ? '' : "\t", @offsets[direction], bytes.map { |byte| Kernel.format('%02x', byte) }.join(' ')))
+              @offsets[direction] += bytes.size
+            end
+          end
+        end
+      ensure
+        original_error = $!
+        begin
+          close
+        rescue StandardError
+          raise unless original_error
+        end
+      end
+      # @rbs () -> void
+      def close = @file.close!
+    end
+  end
+end

data/lib/redhound/output/hexdump.rb

@@ -0,0 +1,29 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Output
+    # @api private
+    class Hexdump
+      # @rbs (?ascii: bool, ?link_layer: bool) -> void
+      def initialize(ascii: false, link_layer: false)
+        @ascii, @link_layer = ascii, link_layer
+      end
+      # @rbs (Packet packet, untyped io) -> void
+      def format(packet, io)
+        offset = @link_layer ? 0 : (packet.layers.find { |l| %i[ipv4 ipv6 arp].include?(l.protocol) }&.offset || 0)
+        data = packet.data.byteslice(offset..) || ''.b
+        pos = 0
+        while pos < data.bytesize
+          chunk = data.byteslice(pos, 16) #: String
+          hex = chunk.unpack('H2' * chunk.bytesize).join(' ')
+          line = Kernel.format('  0x%04x:  %-47s', pos, hex)
+          line += '  ' + chunk.gsub(/[^\x20-\x7e]/n, '.') if @ascii
+          io.write(line.rstrip + "\n")
+          pos += 16
+        end
+      end
+    end
+  end
+end

data/lib/redhound/output/json.rb

@@ -0,0 +1,32 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+require 'json'
+
+module Redhound
+  # @api private
+  module Output
+    # @api private
+    class Json
+      # @rbs (?ndjson: bool) -> void
+      def initialize(ndjson: false)
+        @ndjson, @started = ndjson, false
+      end
+      # @rbs (Packet packet, untyped io) -> void
+      def format(packet, io)
+        if @ndjson
+          io.write(JSON.generate(packet.to_h) + "\n")
+          return
+        end
+        io.write(@started ? ",\n" : "[\n")
+        io.write(JSON.generate(packet.to_h))
+        @started = true
+      end
+      # @rbs (untyped io) -> void
+      def finish(io)
+        return if @ndjson
+        io.write(@started ? "\n]\n" : "[]\n")
+      end
+    end
+  end
+end

data/lib/redhound/output/summary.rb

@@ -0,0 +1,84 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Output
+    # @api private
+    class Summary
+      # @rbs (?timestamp: Symbol, ?precision: Symbol, ?link_layer: bool, ?quick: bool, ?verbosity: Integer, ?resolve_names: bool) -> void
+      def initialize(timestamp: :clock, precision: :micro, link_layer: false, quick: false, verbosity: 0, resolve_names: false)
+        @timestamp = Timestamp.new(style: timestamp, precision: precision)
+        @link_layer, @quick, @verbosity, @resolve_names = link_layer, quick, verbosity, resolve_names
+        @names = {} #: Hash[String, String]
+      end
+      # @rbs (Packet packet) -> String
+      def line(packet)
+        parts = [@timestamp.format(packet)]
+        if packet.interface
+          parts << [packet.interface.name, packet.direction&.to_s&.capitalize].compact.join(' ')
+        end
+        if @link_layer && (eth = packet[:eth])
+          parts << "#{eth.display(:src)} > #{eth.display(:dst)}, ethertype #{eth.display(:type)}, length #{packet.original_length}:"
+        end
+        network = nil #: Layer?
+        transport = nil #: Layer?
+        layer = nil #: Layer?
+        packet.layers.each do |current|
+          next if current.embedded
+          case current.protocol
+          when :ipv4, :ipv6
+            network, transport, layer = current, nil, nil
+          when :tcp, :udp
+            transport = layer = current
+          when :data, :raw, :eth, :vlan, :ipv6_ext, :sll, :sll2, :null
+          else layer = current
+          end
+        end
+        if network
+          src, dst = address(network.display(:src)), address(network.display(:dst))
+          src += ".#{transport[:srcport]}" if transport
+          dst += ".#{transport[:dstport]}" if transport
+          parts << "#{network.protocol == :ipv4 ? 'IP' : 'IP6'} #{src} > #{dst}:"
+        end
+        layer ||= packet.layers.last
+        klass = layer && Registry.default.protocols[layer.protocol]
+        parts << if @quick && transport
+                   "#{transport.protocol.to_s.upcase}, length #{[transport.payload_end - transport.payload_offset, 0].max}"
+                 elsif klass && layer && !layer.error?
+                   klass.new.summary(layer)
+                 else
+                   "#{layer&.protocol.to_s.upcase}, length #{packet.caplen}"
+                 end
+        if @verbosity.positive? && network
+          parts << "ttl #{network[:ttl] || network[:hlim]}"
+          parts << "id #{network.display(:id)}, length #{network[:len]}" if network.protocol == :ipv4
+          parts << "checksum #{network.display(:checksum)}" if network[:checksum]
+          if transport
+            parts << "#{transport.protocol} checksum #{transport.display(:checksum)}"
+            options = transport.fields.select { |field| field.name.start_with?('tcp.options.') }
+            unless options.empty?
+              parts << 'options [' + options.map { |field| "#{field.name.delete_prefix('tcp.options.')} #{field.display}" }.join(', ') + ']'
+            end
+          end
+        end
+        diagnostics = packet.layers.flat_map(&:diagnostics)
+        parts << diagnostics.map { |d| "[#{d.code}]" }.join(' ') unless diagnostics.empty?
+        # All protocol summaries and interface names pass this terminal boundary.
+        text = parts.reject(&:empty?).join(' ').b
+        text.match?(/[^\x20-\x7e]/n) ? text.gsub(/[^\x20-\x7e]/n) { |c| Kernel.format('\\x%02x', c.getbyte(0)) } : text
+      end
+      # @rbs (Packet packet, untyped io) -> void
+      def format(packet, io) = io.write(line(packet) + "\n")
+      # @rbs (String ip) -> String
+      def address(ip)
+        return ip unless @resolve_names
+        return @names[ip] if @names.key?(ip)
+        @names.shift if @names.length >= 256
+        @names[ip] = Addrinfo.ip(ip).getnameinfo.first
+      rescue SocketError
+        ip
+      end
+    end
+  end
+end

data/lib/redhound/output/timestamp.rb

@@ -0,0 +1,34 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Output
+    # @api private
+    class Timestamp
+      # @rbs (?style: Symbol, ?precision: Symbol) -> void
+      def initialize(style: :clock, precision: :micro)
+        @style, @precision, @first, @previous = style, precision, nil, nil
+      end
+      # @rbs (Packet packet) -> String
+      def format(packet)
+        ns = packet.timestamp_ns
+        @first ||= ns
+        value = case @style
+                when :none then ''
+                when :epoch then seconds(ns)
+                when :delta then seconds(@previous ? ns - @previous : 0)
+                when :elapsed then seconds(ns - @first)
+                when :date then packet.time.strftime('%Y-%m-%d %H:%M:%S.') + fraction(ns)
+                else packet.time.strftime('%H:%M:%S.') + fraction(ns)
+                end
+        @previous = ns
+        value
+      end
+      # @rbs (Integer ns) -> String
+      def fraction(ns) = Kernel.format(@precision == :nano ? '%09d' : '%06d', @precision == :nano ? ns % 1_000_000_000 : (ns % 1_000_000_000) / 1000)
+      # @rbs (Integer ns) -> String
+      def seconds(ns) = "#{ns.negative? ? '-' : ''}#{ns.abs / 1_000_000_000}.#{fraction(ns.abs)}"
+    end
+  end
+end

data/lib/redhound/output/tree.rb

@@ -0,0 +1,25 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Output
+    # @api private
+    class Tree
+      # @rbs (Packet packet, untyped io) -> void
+      def format(packet, io)
+        interface = packet.interface ? safe([packet.interface.name, packet.direction&.to_s&.capitalize].compact.join(' ')) + ', ' : ''
+        io.write("Frame #{packet.number}: #{packet.original_length} bytes on wire, #{packet.caplen} captured, #{interface}#{packet.time.utc.strftime('%Y-%m-%d %H:%M:%S')}.#{Kernel.format('%09d', packet.time.nsec)}\n")
+        packet.layers.each_with_index do |layer, depth|
+          klass = Registry.default.protocols[layer.protocol]
+          indent = '   ' * depth
+          io.write("#{indent}└─ #{klass&.protocol_name || layer.protocol}#{layer.embedded ? ' (embedded)' : ''}\n")
+          layer.fields.each { |field| io.write("#{indent}   #{field.name}: #{field.display}\n") }
+          layer.diagnostics.each { |d| io.write("#{indent}   [#{d.severity}] #{d.code}: #{safe(d.message)}\n") }
+        end
+      end
+      # @rbs (String text) -> String
+      def safe(text) = text.b.gsub(/[^\x20-\x7e]/n) { |c| Kernel.format('\\x%02x', c.getbyte(0)) }
+    end
+  end
+end

data/lib/redhound/packet.rb

@@ -0,0 +1,77 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # Captured immutable bytes, metadata, and lazily decoded protocol layers.
+  class Packet
+    # Capture bytes and metadata; timestamp_ns and lengths preserve kernel/file values.
+    attr_reader :data, :timestamp_ns, :original_length, :linktype, :interface, :direction, :number, :meta
+    # Override the dissection engine before accessing layers.
+    attr_accessor :engine
+    # @rbs (String data, ?timestamp_ns: Integer, ?original_length: Integer?, ?linktype: (Integer | Symbol), ?interface: untyped, ?direction: Symbol?, ?number: Integer, ?meta: Hash[Symbol, untyped]) -> void
+    # Copy binary data and preserve capture metadata; reject impossible original lengths.
+    def initialize(data, timestamp_ns: 0, original_length: nil, linktype: 1, interface: nil, direction: nil, number: 1, meta: {})
+      @data = data.b.freeze
+      raise ArgumentError, 'timestamp_ns must be an Integer' unless timestamp_ns.is_a?(Integer)
+      raise ArgumentError, 'number must be a positive Integer' unless number.is_a?(Integer) && number.positive?
+      raise ArgumentError, 'direction must be in, out or nil' unless direction.nil? || direction == :in || direction == :out
+      @timestamp_ns, @original_length = timestamp_ns, original_length.nil? ? data.bytesize : original_length
+      raise ArgumentError, 'original length must be an Integer' unless @original_length.is_a?(Integer)
+      raise ArgumentError, 'original length is shorter than captured length' if @original_length < data.bytesize
+      @linktype = Capture::Linktype.resolve(linktype)
+      @interface, @direction, @number, @meta = interface, direction, number, meta.dup
+      @engine = nil # @rbs Engine?
+    end
+    # @rbs () -> Integer
+    # Number of captured bytes.
+    def caplen = @data.bytesize
+    # @rbs () -> bool
+    # Whether capture omitted bytes from the original packet.
+    def truncated? = caplen < @original_length
+    # @rbs () -> Time
+    # Capture timestamp as a nanosecond-precision Time.
+    def time = Time.at(@timestamp_ns / 1_000_000_000, @timestamp_ns % 1_000_000_000, :nsec)
+    # @rbs () -> Array[Layer]
+    # Decode the protocol chain once and return its Layers.
+    def layers = (@layers ||= (@engine || Engine.default).dissect(self))
+    # @rbs ((Symbol | String) key) -> untyped
+    # Select the first layer by symbol or decoded field by dotted name.
+    def [](key)
+      return layers.find { |l| l.protocol == key } if key.is_a?(Symbol)
+      layers.each do |l|
+        val = l.field_value(key)
+        return val unless val.nil?
+      end
+      nil
+    end
+    # @rbs (Symbol protocol) -> Array[Layer]
+    # Decode the protocol chain once and return its Layers.
+    def layers_of(protocol) = layers.select { |l| l.protocol == protocol }
+    # @rbs (Symbol protocol) -> Layer?
+    # Return the last matching layer in the protocol chain.
+    def innermost(protocol) = layers_of(protocol).last
+    # @rbs (String name) -> Array[untyped]
+    # Return every decoded value of a repeated field.
+    def field_values(name) = layers.flat_map { |l| l.field_values(name) }
+    # @rbs () -> String
+    # Format a numeric one-line packet summary.
+    def summary = Output::Summary.new.line(self)
+    # @rbs () -> Hash[Symbol, untyped]
+    # Return a JSON-compatible packet matching docs/json-schema.json.
+    def to_h
+      { frame: { number: @number, time_epoch_ns: @timestamp_ns, time: time.utc.strftime('%Y-%m-%dT%H:%M:%S.') + format('%09dZ', time.nsec),
+                 caplen: caplen, len: @original_length, interface: json_text(@interface&.name), direction: @direction, linktype: @linktype },
+        layers: layers.map(&:to_h), diagnostics: layers.flat_map { |l| l.diagnostics.map { |d| { layer: l.protocol, severity: d.severity, code: d.code, message: json_text(d.message), field: json_text(d.field) } } } }
+    end
+
+    private
+
+    # @rbs (String? text) -> String?
+    def json_text(text)
+      return nil unless text
+      utf8 = text.dup.force_encoding(Encoding::UTF_8)
+      return utf8 if utf8.valid_encoding?
+      text.unpack1('H*') #: String
+    end
+  end
+end

data/lib/redhound/protocols/arp.rb

@@ -0,0 +1,39 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Arp < Dissector
+      protocol :arp, name: 'Address Resolution Protocol', short: 'ARP'
+      dissects_on 'ethertype', 0x0806
+      header do
+        uint16 :hwtype, 'arp.hw.type'
+        uint16 :protype, 'arp.proto.type'
+        uint8 :hwlen, 'arp.hw.size'
+        uint8 :prolen, 'arp.proto.size'
+        uint16 :opcode, 'arp.opcode'
+      end
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        hlen, plen = layer[:hwlen], layer[:prolen]
+        cursor = ctx.cursor
+        cursor.check(8, (hlen + plen) * 2)
+        if hlen == 6 && plen == 4 && layer[:protype] == 0x0800
+          layer.add(:sha, 'arp.src.hw_mac', cursor.bytes(8, 6), type: :mac, offset: 8, length: 6)
+          layer.add(:spa, 'arp.src.proto_ipv4', cursor.u32(14), type: :ipv4, offset: 14, length: 4)
+          layer.add(:tha, 'arp.dst.hw_mac', cursor.bytes(18, 6), type: :mac, offset: 18, length: 6)
+          layer.add(:tpa, 'arp.dst.proto_ipv4', cursor.u32(24), type: :ipv4, offset: 24, length: 4)
+        end
+        layer.header_length = 8 + 2 * (hlen + plen)
+        layer.payload_end = layer.payload_offset = layer.offset + layer.header_length
+      end
+      # @rbs (Layer layer) -> String
+      def summary(layer)
+        layer[:opcode] == 1 ? "ARP, Request who-has #{layer.display(:tpa)} tell #{layer.display(:spa)}" :
+                             "ARP, Reply #{layer.display(:spa)} is-at #{layer.display(:sha)}"
+      end
+    end
+  end
+end

data/lib/redhound/protocols/checksum.rb

@@ -0,0 +1,38 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    module Checksum
+      # @rbs (String bytes) -> Integer
+      def self.value(bytes)
+        sum = bytes.unpack('n*').sum
+        sum += bytes.getbyte(-1).to_i << 8 if bytes.bytesize.odd?
+        sum = (sum & 0xffff) + (sum >> 16) while sum > 0xffff
+        (~sum) & 0xffff
+      end
+      # @rbs (Context ctx, Layer layer, String bytes, ?Integer? proto) -> void
+      def self.verify(ctx, layer, bytes, proto = nil)
+        return unless ctx.verify_checksums?
+        network = ctx.network
+        fragmented = network&.[](:mf) == 1 || ctx.layers.any? { |part| part.protocol == :ipv6_ext && part[:more] == 1 }
+        if ctx.packet.direction == :out || ctx.packet.meta[:csum_not_ready] || ctx.embedded || fragmented
+          layer.diagnose(:note, :checksum_unverified, 'checksum not verified (offloaded or incomplete)')
+          return
+        end
+        if proto && network
+          src, dst = network[:src], network[:dst]
+          pseudo = if network.protocol == :ipv4
+                     [src, dst, 0, proto, bytes.bytesize].pack('NNCCn')
+                   else
+                     src + dst + [bytes.bytesize, proto].pack('Nx3C')
+                   end
+          bytes = pseudo + bytes
+        end
+        layer.diagnose(:warn, :bad_checksum, 'checksum does not match') unless value(bytes).zero?
+      end
+    end
+  end
+end

data/lib/redhound/protocols/data.rb

@@ -0,0 +1,23 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  # @api private
+  module Protocols
+    # @api private
+    class Data < Dissector
+      LENGTH_FIELD = FieldDefinition.new(:length, 'data.len', :uint, 0, 0, 0, nil, nil, 1, nil, nil)
+      protocol :data, name: 'Data', short: 'DATA'
+      # @rbs (Context ctx, Layer layer) -> void
+      def dissect(ctx, layer)
+        length = ctx.cursor.remaining
+        layer.definitions << LENGTH_FIELD
+        layer.values[:length] = length
+        layer.add(:data, 'data.data', ctx.cursor.bytes(0, length), type: :bytes, length: length)
+        layer.payload_offset = layer.payload_end
+      end
+      # @rbs (Layer layer) -> String
+      def summary(layer) = "DATA, length #{layer[:length]}"
+    end
+  end
+end