Nfrb is a very simple yet fast gem that can be used to parse nfcapd files.
~# git clone git://github.com/dguerri/nfrb.git ~# cd nfrb ~# bundle install ~# rake install
~# gem install nfrb
gem "nfrb", "~> 0.1.2"
nfrb-bech.rb:
require 'nfrb' raise ArgumentError, "Missing nfcapd files" if ARGV.count < 1 nfparser = NfRb::NfReader.new i=0 start_t = Time.now nfparser.process_files(ARGV) do |flow| # puts flow.inspect(); i+=1 end stop_t = Time.now puts "#{i} flows processed in #{stop_t - start_t} seconds." puts "Flows per seconds = #{i / (stop_t - start_t)}"
# bundle exec ruby nfrb-bech.rb nfcapd.201112181720 325602 flows processed in 0.67114 seconds. Flows per seconds = 488513.404029311
Copyright © 2011-2012 Davide Guerri. See LICENSE.txt for further details.