Process PCAP Data from Socket

[Bryan Richardson]

Hello all,

I'm wondering if it's possible at all to process PCAP data using Ruby's
pcap library when the data's being piped through a socket. The pcap
library has capture methods for live capture from a device or offline
via a file. I'm piping PCAP data from a remote machine to my machine
using netcat, and I want to be able to process it in real-time on my
machine.

Does anyone know if I can pass an IO handle to the offline method in the
Ruby pcap library?

 

[Eleanor McHugh]

I'm wondering if it's possible at all to process PCAP data using
Ruby's
pcap library when the data's being piped through a socket. The pcap
library has capture methods for live capture from a device or offline
via a file. I'm piping PCAP data from a remote machine to my machine
using netcat, and I want to be able to process it in real-time on my
machine.

Does anyone know if I can pass an IO handle to the offline method in
the
Ruby pcap library?

I can't comment on your particular case, but assuming your box is much
faster than the network link reading data in realtime and doing
something with it is certainly possible. If you follow the link in my
sig and grab a copy of the Camping presentation there are some
examples of using Ruby PCAP that may help.


Ellie

Eleanor McHugh
Games With Brains
http://slides.games-with-brains.net