Status of libpcap

[Ghislain Mary]

Hi all,

I found the ruby-libpcap library from
http://www.goto.info.waseda.ac.jp/~fukusima/ruby/pcap-e.html but
unfortunately this library seems quite a bit old (based on libpcap-0.6 I
think).

So I was wondering if you know of an other library to handle pcap files
in ruby or if someone is working on a newer version for this library. If
not, I could try to update it to handle the last version of libpcap.

Thanks,

Ghislain MARY

 

[Martin Pirker]

I've used that library and linked against libpcap 0.8.3. I don't think the
libpcap API has changed much.

A dumpfile of e.g. Ethereal sometimes causes exceptions when opened by
Pcap::Capture.open_offline, seems some new structures are not (yet)
handled by the Ruby bindings.

The only change I made was to correct a run-time warning to do with symbols.
See patch below.

This fixes the warnings, thanks!


Martin

 

[Ghislain Mary]

Hi,

Martin Pirker a écrit :

A dumpfile of e.g. Ethereal sometimes causes exceptions when opened by
Pcap::Capture.open_offline, seems some new structures are not (yet)
handled by the Ruby bindings.

Yes, that's exactly the problem I'm having. I try to load a capture of
IEEE802.11 frames with prism headers. Opening my capture file with
Pcap::Capture.open_offline and trying to iterate over each packets I get
a PcapError telling me "Unknow data-link type 119" which corresponds to
the libcap constant DLT_PRISM_HEADER. So I have managed to define this
constant in ruby-pcap. But that is not sufficient. But as it is done for
now, in packet.c the struct datalinks suppose that the ids of the
different datalinks types are incremented by 1, whereas this is not the
case, having gaps between different constants in the libpcap. So it
looks like that this is not that easy to make it work. I'll keep telling
here what I find, and if someone could help me that would be wery cool

Ghislain