pcaprub¶ ↑

This goal of this project is to provide a consistent interface to LBL’s libpcap packet capture library. This project was created because the currently available ruby-pcap library is poorly designed and has been unmaintained since 2000.

This does not provide packet processing functionality, it simply provides the interface for capturing packets, and passing yielding those packets.

For true packet processing capability look at PCAPFU PCAPLET etc..

Requirements:

libpcap - http://www.tcpdump.org

Installation ¶ ↑

gem install pcaprub

Usage¶ ↑

require 'rubygems'
require 'pcaprub'

cap = PCAPRUB::Pcap.new

Current Repository for Gemcutter source¶ ↑

The Git Repo on Github @shadowbq is forked from the Metasploit SVN repo

git clone git://github.com/shadowbq/pcaprub.git

Notes on 11.x series and beyond.¶ ↑

The gem is now a module. The module is autoincluded, but this helps with name collisions and additional growth.

Some of the Error handling and basic intensive code is moving out the C base-extension (ext) and into native Ruby.

The file handling in dumper is now attached to the Capture Class and not the Module as an additional singleton.

capture = PCAPRUB::Pcap.open_live('eth0', SNAPLENGTH, true, 0)
capture.dump_open('./Example.pcap') 
  { ... }
capture.dump_close

Timstamps from the PCAP Header ¶ ↑

Timestamps are now available when yeilding packets instead of strings

capture = PCAPRUB::Pcap.open_live('eth0', SNAPLENGTH, true, 0)
capture.each_packet do |packet|
  puts Time.at(packet.time)
  puts "micro => #{packet.microsec}"
end

Notes on other repositories¶ ↑

The Metasploit Project also provides a Subversion repository: (0.9-dev)

svn checkout http://metasploit.com/svn/framework3/trunk/external/pcaprub/

Packetfu Project also provides a listing (0.9-dev)

http://code.google.com/p/packetfu/source/browse/#svn/trunk/pcaprub_linux

The Outdate RubyForge svn version can be obtained from Subversion: (0.7-dev)

svn checkout http://pcaprub.rubyforge.org/svn/trunk/
http download Public Rubyforge (0.6)

SourceForge Masaki Fukushima 2000 (0.6) – Object Creation Heavy Implementation (PCAPLET integrated)

http://sourceforge.net/apps/trac/rubypcap/

Additonal Github Repos

github.com/dxoigmn/pcaprub (0.8-dev)
github.com/spox /pcaprub-spox  (0.8-dev+)