# Process PCAP Data from Socket

**URL:** <https://www.ruby-forum.com/t/process-pcap-data-from-socket/160462>\
**Category:** Ruby\
**Created:** [February 16, 2009, 5:14pm UTC](https://www.ruby-forum.com/t/process-pcap-data-from-socket/160462 "2009-02-16T17:14:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![roxah](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/54ee81/32.png) [@roxah](https://www.ruby-forum.com/u/roxah)\
**Post date:** [February 16, 2009, 5:14pm UTC](https://www.ruby-forum.com/t/process-pcap-data-from-socket/160462/1 "2009-02-16T17:14:50Z")

</div>

Hello all,

I’m wondering if it’s possible at all to process PCAP data using Ruby’s  
pcap library when the data’s being piped through a socket. The pcap  
library has capture methods for live capture from a device or offline  
via a file. I’m piping PCAP data from a remote machine to my machine  
using netcat, and I want to be able to process it in real-time on my  
machine.

Does anyone know if I can pass an IO handle to the offline method in the  
Ruby pcap library?

–  
Thanks!  
Bryan

---

<div class="post-metadata">

**Author:** ![roxah](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/54ee81/32.png) [@roxah](https://www.ruby-forum.com/u/roxah)\
**Post date:** [February 17, 2009, 3:40pm UTC](https://www.ruby-forum.com/t/process-pcap-data-from-socket/160462/2 "2009-02-17T15:40:14Z")

</div>

On 16 Feb 2009, at 16:16, Bryan R. wrote:

> Ruby pcap library?  
> I can’t comment on your particular case, but assuming your box is much  
> faster than the network link reading data in realtime and doing  
> something with it is certainly possible. If you follow the link in my  
> sig and grab a copy of the Camping presentation there are some  
> examples of using Ruby PCAP that may help.

Ellie

## Eleanor McHugh Games With Brains [http://slides.games-with-brains.net](http://slides.games-with-brains.net)

raise ArgumentError unless @reality.responds\_to? :reason