# Ruby/pcap with threads **URL:** \ **Category:** Ruby\ **Created:** [November 16, 2007, 6:46am UTC](https://www.ruby-forum.com/t/ruby-pcap-with-threads/120359 "2007-11-16T06:46:09Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![kenny\_roytman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/958977/32.png) [@kenny\_roytman](https://www.ruby-forum.com/u/kenny_roytman)\ **Post date:** [November 16, 2007, 6:46am UTC](https://www.ruby-forum.com/t/ruby-pcap-with-threads/120359/1 "2007-11-16T06:46:09Z")
Hi Everyone, Can someone please explain why I don’t see any output from the following code? I’m stumped. By the way, “en1” is the name of my network device. Thanks. code: ``` 1 require 'pcaplet' 2 3 include Pcap 4 5 6 x = Thread.new { 7 pcaplet = Pcaplet.new("-i en1") 8 9 pcaplet.each_packet { |pkt| 10 puts "#{pkt.src.to_num_s}:#{pkt.sport} ``` #{pkt.dst.to\_num\_s}:#{pkt.dport}" if pkt.ip? 11 } 12 13 } 14 15 x.join 16 ---
**Author:** ![kenny\_roytman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/958977/32.png) [@kenny\_roytman](https://www.ruby-forum.com/u/kenny_roytman)\ **Post date:** [November 16, 2007, 9:05am UTC](https://www.ruby-forum.com/t/ruby-pcap-with-threads/120359/2 "2007-11-16T09:05:54Z")
From: kenny roytman [[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)] # Hi Everyone, # Can someone please explain why I don’t see any output from the # following code? I’m stumped. By the way, “en1” is the name of my # network device. Thanks. # # code: # 1 require ‘pcaplet’ # 2 # 3 include Pcap # 4 # 5 # 6 x = Thread.new { # 7 pcaplet = Pcaplet.new(“-i en1”) # 8 # 9 pcaplet.each\_packet { |pkt| # 10 puts "#{pkt.src.to\_num\_s}:#{pkt.sport} # #{pkt.dst.to\_num\_s}:#{pkt.dport}" if pkt.ip? # 11 } # 12 # 13 } # 14 # 15 x.join # 16 i simplified your code, but it works… pcaplet is quite old, you might try modifying some to remove deprecation warnings… botp@pc4all:~/pcap$ cat test.rb require ‘pcaplet’ include Pcap x = Thread.new { pcaplet = Pcaplet.new(“-i eth0”) pcaplet.each\_packet { |pkt| puts pkt } } x.join botp@pc4all:~/pcap$ sudo ruby test.rb /usr/local/lib/ruby/site\_ruby/1.8/i686-linux/pcap.so: warning: do not use Fixnums as Symbols /usr/local/lib/ruby/site\_ruby/1.8/i686-linux/pcap.so: warning: do not use Fixnums as Symbols /usr/local/lib/ruby/site\_ruby/1.8/i686-linux/pcap.so: warning: do not use Fixnums as Symbols 10.2.87.95:6771 \> 239.192.152.143:6771 len 127 sum 35035 pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP… pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP… 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A… pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP… pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP… 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A… pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP… pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP… 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A… pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP… pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP… 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A… pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP… pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP… 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A… pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP… pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP… 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A… pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP… kind regards -botp ---
**Author:** ![kenny\_roytman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/958977/32.png) [@kenny\_roytman](https://www.ruby-forum.com/u/kenny_roytman)\ **Post date:** [November 16, 2007, 4:56pm UTC](https://www.ruby-forum.com/t/ruby-pcap-with-threads/120359/3 "2007-11-16T16:56:47Z")
On Nov 16, 2:05 am, Peña, Botp [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > # 4 > > # 14 > > pcaplet = Pcaplet.new(“-i eth0”) > 10.2.87.95:6771 \> 239.192.152.143:6771 len 127 sum 35035 > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP… > kind regards -botp > wierd, i’m not seeing this behavior. I’m running on Mac OS X. I > wonder if that’s a problem … ---
**Author:** ![kenny\_roytman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/958977/32.png) [@kenny\_roytman](https://www.ruby-forum.com/u/kenny_roytman)\ **Post date:** [November 17, 2007, 4:27am UTC](https://www.ruby-forum.com/t/ruby-pcap-with-threads/120359/4 "2007-11-17T04:27:31Z")
On Nov 16, 2007, at 07:55 , kenny roytman wrote: > wierd, i’m not seeing this behavior. I’m running on Mac OS X. I > wonder if that’s a problem … I had to go with a fork model for OS X, something in pcap doesn’t allow switching threads. See Capture#run for a stupid-simple way of doing this: [http://segment7.net/projects/ruby/snippets/httpdump.rb](http://segment7.net/projects/ruby/snippets/httpdump.rb) If you need better communication, instead of parsing #inspect output, use Marshal.dump and Marshal.load.