class PacketFu::PcapNG::EPB
Pcapng::EPB represents a Extended Packet
Block
(EPB) of a pcapng file.
Pcapng::EPB Definition¶ ↑
Int32 :type Default: 0x00000006 Int32 :block_len Int32 :interface_id Int32 :tsh (timestamp high) Int32 :tsl (timestamp low) Int32 :cap_len Int32 :orig_len String :data String :options Int32 :block_len2
Constants
- MIN_SIZE
Attributes
endian[RW]
interface[RW]
Public Class Methods
new(args={})
click to toggle source
Calls superclass method
# File lib/packetfu/pcapng/epb.rb, line 28 def initialize(args={}) @endian = set_endianness(args[:endian] || :little) init_fields(args) super(args[:type], args[:block_len], args[:interface_id], args[:tsh], args[:tsl], args[:cap_len], args[:orig_len], args[:data], args[:options], args[:block_len2]) end
Public Instance Methods
has_options?()
click to toggle source
# File lib/packetfu/pcapng/epb.rb, line 51 def has_options? self[:options].size > 0 end
init_fields(args={})
click to toggle source
Used by initialize to set the initial fields
# File lib/packetfu/pcapng/epb.rb, line 37 def init_fields(args={}) args[:type] = @int32.new(args[:type] || PcapNG::EPB_TYPE.to_i) args[:block_len] = @int32.new(args[:block_len] || MIN_SIZE) args[:interface_id] = @int32.new(args[:interface_id] || 0) args[:tsh] = @int32.new(args[:tsh] || 0) args[:tsl] = @int32.new(args[:tsl] || 0) args[:cap_len] = @int32.new(args[:cap_len] || 0) args[:orig_len] = @int32.new(args[:orig_len] || 0) args[:data] = StructFu::String.new(args[:data] || '') args[:options] = StructFu::String.new(args[:options] || '') args[:block_len2] = @int32.new(args[:block_len2] || MIN_SIZE) args end
read(str_or_io)
click to toggle source
Reads a String or a IO to populate the object
# File lib/packetfu/pcapng/epb.rb, line 56 def read(str_or_io) if str_or_io.respond_to? :read io = str_or_io else io = StringIO.new(force_binary(str_or_io.to_s)) end return self if io.eof? self[:type].read io.read(4) self[:block_len].read io.read(4) self[:interface_id].read io.read(4) self[:tsh].read io.read(4) self[:tsl].read io.read(4) self[:cap_len].read io.read(4) self[:orig_len].read io.read(4) self[:data].read io.read(self[:cap_len].to_i) data_pad_len = (4 - (self[:cap_len].to_i % 4)) % 4 io.read data_pad_len options_len = self[:block_len].to_i - self[:cap_len].to_i - data_pad_len options_len -= MIN_SIZE self[:options].read io.read(options_len) self[:block_len2].read io.read(4) unless self[:block_len].to_i == self[:block_len2].to_i raise InvalidFileError, 'Incoherency in Extended Packet Block' end self end
timestamp()
click to toggle source
Return timestamp as a Time object
# File lib/packetfu/pcapng/epb.rb, line 87 def timestamp Time.at((self[:tsh].to_i << 32 | self[:tsl].to_i) * ts_resol) end
to_s()
click to toggle source
Return the object as a String
# File lib/packetfu/pcapng/epb.rb, line 92 def to_s pad_field :data, :options recalc_block_len to_a.map(&:to_s).join end
Private Instance Methods
ts_resol()
click to toggle source
# File lib/packetfu/pcapng/epb.rb, line 101 def ts_resol if @interface.nil? 1E-6 else @interface.ts_resol end end