Skip to content
Ruby FFI bindings for libpcap.
Branch: master
Clone or download
postmodern Merge pull request #10 from bartleusink/patch-1
function "activate" should be "pcap_activate"
Latest commit 55b87f7 Feb 20, 2014
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
examples finish doc on example code Sep 7, 2010
lib Merge pull request #10 from bartleusink/patch-1 Feb 20, 2014
spec Fixed the FileHeader specs. Feb 10, 2013
tasks restored Rakefile with a hacky dual-mode Aug 14, 2010
.gitignore ignore the .justrake file Aug 14, 2010
.pkg_ignore ignore the .justrake file Aug 14, 2010
.rspec Added options for RSpec. Jul 24, 2012
.specopts Switch to Markdown formatted files, and reset the Rakefile. May 11, 2010
.travis.yml Sudo rake test on travis-ci.org Apr 6, 2013
.yardopts
ChangeLog.md doc Sep 7, 2010
LICENSE.txt Updated the LICENSE Feb 10, 2013
README.md Updated the README. Feb 10, 2013
Rakefile Updated the development dependencies. Feb 10, 2013
ffi-pcap.gemspec Updated the gemspec. Feb 10, 2013
gemspec.yml Updated the development dependencies. Feb 10, 2013

README.md

ffi-pcap

Description

Ruby FFI bindings for libpcap.

Features

Exposes all features of the libpcap library including live packet capture, offline packet capture, live packet injection, etc..

Currently, FFI::PCap does not supply any packet dissection routines. The choice of what to use is left up to you.

Packet dissection libraries:

  • ffi-packets - Maps raw packets to FFI::Struct objects.

Examples

Reading ICMP packets from a live interface.

require 'rubygems'
require 'ffi/pcap'

pcap =
  FFI::PCap::Live.new(:dev => 'lo0',
                      :timeout => 1,
                      :promisc => true,
                      :handler => FFI::PCap::Handler)

pcap.setfilter("icmp")

pcap.loop() do |this,pkt|
  puts "#{pkt.time}:"

  pkt.body.each_byte {|x| print "%0.2x " % x }
  putc "\n"
end

Reading packets from a pcap dump file:

require 'rubygems'
require 'ffi/pcap'

pcap = FFI::PCap::Offline.new("./foo.cap")

pcap.loop() do |this,pkt|
  puts "#{pkt.time}:"

  pkt.body.each_byte {|x| print "%0.2x " % x }
  putc "\n"
end

Replaying packets from a pcap dump file on a live interface:

require 'rubygems'
require 'ffi/pcap'

live = FFI::PCap::Live.new(:device => 'en0')
offline = FFI::PCap::Offline.new("./foo.cap")

if live.datalink == offline.datalink
  offline.loop() {|this,pkt| live.inject(pkt) }
end

Requirements

Install

$ sudo gem install ffi-pcap

License

See {file:LICENSE.txt} for license information.

You can’t perform that action at this time.