Libpcap with Ruby

Rails
1

I just try some script from fukusima

http://www.goto.info.waseda.ac.jp/~fukusima/ruby/pcap/examples/

When I try to run the script it give a warning

/usr/lib/ruby/site_ruby/1.8/i686-linux/pcap.so: warning: do not use
Fixnums as Symbols
/usr/lib/ruby/site_ruby/1.8/i686-linux/pcap.so: warning: do not use
Fixnums as Symbols
/usr/lib/ruby/site_ruby/1.8/i686-linux/pcap.so: warning: do not use
Fixnums as Symbols

Is there any mistake or library that I didn’t include ?

I also try this code :

#!/usr/bin/env ruby

this line imports the libpcap ruby bindings

require ‘pcaplet’

create a sniffer that grabs the first 1500 bytes of each packet

$network = Pcaplet.new(‘-s 1500’)

create a filter that uses our query string and the sniffer we just

made
$filter = Pcap::Filter.new(‘tcp and dst port 80’, $network.capture)

add the new filter to the sniffer

$network.add_filter($filter)

iterate over every packet that goes through the sniffer

for p in $network

print packet data for each packet that matches the filter

puts p.tcp_data if $filter =~ p
end

and suppose it appear some output after run it, nothing appear :frowning:

anyone have some solutions ?

thanks in advance

2

On 14 Sep 2008, at 19:27, FryShadow wrote:

Fixnums as Symbols
/usr/lib/ruby/site_ruby/1.8/i686-linux/pcap.so: warning: do not use
Fixnums as Symbols

Is there any mistake or library that I didn’t include ?

that library is just a little old.
http://lists.freebsd.org/pipermail/freebsd-ports-bugs/2008-May/141159.html
looks like it should fix it ( i did something very similar my self a
long time ago)

create a filter that uses our query string and the sniffer we just

end

and suppose it appear some output after run it, nothing appear :frowning:

did you run it as root ?

The script i had looked more like.

$network.each_packet do |p|
…
end

You don’t need to check if the packet matches the filter - it will
only get passed to you if it does.

Fred

3

Yup, I run the script with root

Look like the library is quite old, is it still working ? :slight_smile:

On Sep 14, 11:39 am, Frederick C. [email protected]

4

On 14 Sep 2008, at 19:56, FryShadow wrote:

Yup, I run the script with root

Look like the library is quite old, is it still working ? :slight_smile:

was working for me a few months ago

Fred