Ruby/Pcap extension library

Ruby interface to LBL Packet Capture library. This library also includes classes to access packet header fields.

It is much easier to code in Ruby/Pcap than to code in C and use libpcap directly. For example, tcpdump-like (very simple) script is written as this.

Ruby/Pcap needs libpcap. Latest libpcap distribution is here. (Original LBL version is here) Ruby/Pcap will run in any environment in which both ruby and libpcap are supported.

Documentation

• Manual
• Example scripts

Download

• ruby-pcap-0.6.tar.gz
• Debian package by akira yamada, a member of Debian.
• FreeBSD Ports by knu.
• Major Changes:
  • Changes from 0.5 to 0.6:
    • Filter usability improved when linked with libpcap-0.5.
    • Filter logical operation implemented.
    • Pcaplet can read .gz file
    • Miscellaneous improvements.
  • Changes from 0.4 to 0.5:
    • Filter class added.
    • Bug fixes.
  • Changes from 0.3.1 to 0.4:
    • Support ICMP.
    • Some classes are renamed. (IpPacket => IPPacket etc.) Former names remain intact for backward compatibility.
    • Bug fixes, manual updates.
  • Changes from 0.3 to 0.3.1:
    • Capture#loop is now thread-friendly.
  • Changes from 0.2 to 0.3:
    • Based on ruby-1.3.x.
  • Changes from 0.1.1 to 0.2:
    • Support UDP.

Related Links

• Latest libpcap/tcpdump
• LBNL's Network Research Group
• Net::RawIP Perl module to manipulate raw IP and libpcap.
• py-libpcap Python module that interfaces to libpcap.
• libpcap for Win32