开发者

Ruby PCAP Reading a complete capture file

I am using Ruby to process some PCAP files. I need to read a complete file and analyze each pcaket.

require 'pcap'

inFile = Pcap::Capture.open_offline("1.pcap")

inFile.loop(-1) do |pkt|
#Process packet.
end

Above code does not exit after reading all the packets. According to the Ruby pcap documentation 'A negative count processes packets forever or until EOF is reached'. What can be t开发者_JAVA技巧he problem here.


I'm using a variation of the below a lot for ad-hoc packet analysis. Works for me. Ruby 1.9.3-p125, pcaprub 0.11.2.

#!/opt/local/bin/ruby1.9
require 'pcaprub'

fn = ARGV[1] || "pcap-000"
pc = Pcap.open_offline(ARGV[0])
pc.each do |pk|
  fn1 = fn.succ!
  File.binwrite(fn1, pk)
end
0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜