read_pcap: Read in a packet capture file

In hrbrmstr/crafter: Tools to Analyze and Visualize Network Packet Capture ('PCAP') Files

Description

Reads in a packet capture file and returns an hyrid S3 crafter object with internal methods and accessible variables.

Usage

read_pcap(capture_file, filter = "")

Arguments

capture_file	path to a PCAP
filter	filter

Details

Callable internal methods & accesible variables of the crafter object:

packet_count

Total packets in capture

get_ips(src_or_dst)

Retrieve a data frame of IP addresses. "src_or_dst" can be one of "src", "dst" or "all"

packet_info()

Retrieve a data frame of high-level packet information

get_payload(num)

Retrieve the payload of a specific packet number

get_layer(layer_name)

Get all the packets from a layer, "layer_name" can be one of TCP, IP, ICMP

summary()

Prints summary information about the packet capture

Value

A crafter hybrid S3 object

References

pcap filter reference

Examples

ncap <- read_pcap(system.file("pcaps/Ncapture.pcap", package="crafter"))

# get overall capture summary
summary(ncap)

# same thing
ncap$summary()

# high level packet info
ncap_info <- ncap$packet_info()
head(ncap_info)

# retrieve specific layers
ncap_ip <- ncap$get_layer("IP")
head(ncap_ip)

ncap_tcp <- ncap$get_layer("TCP")
head(ncap_tcp)

# get the IPs from the capture
ncap$get_ips("all")

# get packet payload
ncap$get_payload(7119)

hrbrmstr/crafter documentation built on May 17, 2019, 4:56 p.m.