isc.util.pcap
Class javacap

java.lang.Object
  isc.util.pcap.javacap

public class javacap
extends java.lang.Object

This is a very rough RMI cover over the pcap library. This library was adapted from jpcap.sourceforge.net. I added a number of routines and restructured some of the code. please refer to man pcap, for details on pcap files

Author:

John Casey

DNA_sensor - Aug 12, 2005

See Also:

PCAP man pages

Field Summary

int	EOF pcap end of file flag
int	PROTOCOL_IP Protocol constant for IPV4.
int	PROTOCOL_PPOE Protocol constant for PPOE
int	PROTOCOL_PPOE_IP

Constructor Summary

javacap()
Create a new javacap Object Initialize packet buffer to default 4k

javacap(int size)
Create a new javacap Object Intialize packet buffer to specified size

Method Summary

int	_open_offline(java.lang.String fname, byte[] errbuf) RMI method for opening an existing pcap file
void	_parseL2Headers(byte[] b, byte[] l2hdr, byte[] l2encap, int caplen) Parse the the packet for the layer2 header and encapsulation
int	_read_next(byte[] b, byte[] l2hdr, byte[] l2encap) Read a packet form a capture device.
int	_read(byte[] b, byte[] l2hdr) RMI method for reading the next packet from the device
void	close() Close the network capture device
void	dump_close() Close the pcap file opened by dump_open()
int	dump_flush() flush the pcap file to disk
int	dump_open(java.lang.String filename, int linktype, int snaplen, byte[] errbuf) Create a pcap file
void	dump_write(long timestamp, long nanoseconds, byte[] data, int datasize) Write a packet to a previously opened dump file
int	findAllDevices(java.lang.String[] devices, java.lang.String[] Desc, byte[] errbuf) Enumerates all of the device available for capture
int	getCapturedLength()
byte[]	getData() Get the read packet data
int	getDataLinkType()
long	getDevicePacketTimestampMicroseconds() Get the packet microseconds of the timestamp, from the previously read packet
long	getDevicePacketTimestampSeconds() Get the packet timestamp, from the previously read packet
int	getDroppedPackets()
java.lang.String	getError()
int	getEthHeaderProto() Get the protocol information from the ethernet header
int	getFilePacketLength()
long	getFilePacketTimestampMicroseconds() Get the packet microseconds of the timestamp, from the previously read packet
long	getFilePacketTimestampSeconds() Get the packet timestamp, from the previously read packet
int	getNextProto(byte[] hdr, int offset)
int	getPacketLength()
int	getPacketProtocol()
int	getReceivedPackets()
boolean	isFileOpen() Check if the pcap file is open
boolean	open_offline(java.lang.String fname, byte[] errbuf) Open the pcap file
void	open(java.lang.String name, int bufferSize) Open a network device for reading
void	read(byte[] b)
int	readDeviceNextPacket()
int	readFileNextPacket() Read the next packet from the pcap file
int	setFilter(java.lang.String rule, int netmask)
int	size() Returns the size of the allocated packet length

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

PROTOCOL_IP

public final int PROTOCOL_IP

Protocol constant for IPV4.

See Also:

Constant Field Values

PROTOCOL_PPOE

public final int PROTOCOL_PPOE

Protocol constant for PPOE

See Also:

Constant Field Values

PROTOCOL_PPOE_IP

public final int PROTOCOL_PPOE_IP

See Also:

Constant Field Values

EOF

public final int EOF

pcap end of file flag

See Also:

Constant Field Values

Constructor Detail

javacap

public javacap()

Create a new javacap Object Initialize packet buffer to default 4k

javacap

public javacap(int size)

Create a new javacap Object Intialize packet buffer to specified size

Parameters:

size - size of the packet buffer to use.

Method Detail

read

public void read(byte[] b)

getError

public java.lang.String getError()

setFilter

public int setFilter(java.lang.String rule,
                     int netmask)

open

public void open(java.lang.String name,
                 int bufferSize)

Open a network device for reading

Parameters:

name - Name of he device

bufferSize - Size of buffer to be read

close

public void close()

Close the network capture device

getReceivedPackets

public int getReceivedPackets()

Returns:

The number of packets read from the device since open()

getDroppedPackets

public int getDroppedPackets()

Returns:

The number of packets dropped since open()

getDataLinkType

public int getDataLinkType()

Returns:

The datalink type when the device was opened.

getPacketLength

public int getPacketLength()

Returns:

length of the packet just read

getCapturedLength

public int getCapturedLength()

Returns:

getFilePacketLength

public int getFilePacketLength()

Returns:

The length the packet just read from a file

findAllDevices

public int findAllDevices(java.lang.String[] devices,
                          java.lang.String[] Desc,
                          byte[] errbuf)

Enumerates all of the device available for capture

Parameters:

devices - Array of strings to be filled in containing the devices

Desc - Array of strings to be filed in containing the descriptions

errbuf - error mesages if return = -1

Returns:

return status 0=success, -1= failure

dump_open

public int dump_open(java.lang.String filename,
                     int linktype,
                     int snaplen,
                     byte[] errbuf)

Create a pcap file

Parameters:

filename - The name of the file to create

linktype - The link type

snaplen - The buffer size

dump_write

public void dump_write(long timestamp,
                       long nanoseconds,
                       byte[] data,
                       int datasize)

Write a packet to a previously opened dump file

Parameters:

timestamp - Timestamp in milliseconds of the packet

nanoseconds - nanoseconds of the packets

data - the packet data

datasize - the size of the packet data

dump_close

public void dump_close()

Close the pcap file opened by dump_open()

dump_flush

public int dump_flush()

flush the pcap file to disk

Returns:

_read_next

public int _read_next(byte[] b,
                      byte[] l2hdr,
                      byte[] l2encap)

Read a packet form a capture device. seperate out the data, layer 2 header, and any encapsulation layers

Parameters:

b - The data

l2hdr - the layer 2 header

l2encap - the encapsulation layer

Returns:

0=success, -1=failure

_parseL2Headers

public void _parseL2Headers(byte[] b,
                            byte[] l2hdr,
                            byte[] l2encap,
                            int caplen)

Parse the the packet for the layer2 header and encapsulation

Parameters:

b - the packet

l2hdr - layer2 header

l2encap - encapsulation

caplen - capturelen

_read

public int _read(byte[] b,
                 byte[] l2hdr)

RMI method for reading the next packet from the device

Parameters:

_data - Contains the IP packet

_ethdata - Contains the ethernet header

Returns:

getDevicePacketTimestampSeconds

public long getDevicePacketTimestampSeconds()

Get the packet timestamp, from the previously read packet

Returns:

The timestamp in seconds

getDevicePacketTimestampMicroseconds

public long getDevicePacketTimestampMicroseconds()

Get the packet microseconds of the timestamp, from the previously read packet

Returns:

Microseconds of the timestamp

_open_offline

public int _open_offline(java.lang.String fname,
                         byte[] errbuf)

RMI method for opening an existing pcap file

Parameters:

fname - The name of the pcap fle to be opened

errbuf - The error message if the file could not be opened

getFilePacketTimestampSeconds

public long getFilePacketTimestampSeconds()

Get the packet timestamp, from the previously read packet

Returns:

The timestamp in seconds

getFilePacketTimestampMicroseconds

public long getFilePacketTimestampMicroseconds()

Get the packet microseconds of the timestamp, from the previously read packet

Returns:

Microseconds of the timestamp

isFileOpen

public boolean isFileOpen()

Check if the pcap file is open

Returns:

True if open

open_offline

public boolean open_offline(java.lang.String fname,
                            byte[] errbuf)

Open the pcap file

Parameters:

fname - Name of the file to open

errbuf - Error message if failed

Returns:

True if succeeded

size

public int size()

Returns the size of the allocated packet length

Returns:

size in bytes

readDeviceNextPacket

public int readDeviceNextPacket()

Returns:

readFileNextPacket

public int readFileNextPacket()

Read the next packet from the pcap file

Returns:

EOF when reached

getData

public byte[] getData()

Get the read packet data

Returns:

The packet

getEthHeaderProto

public int getEthHeaderProto()

Get the protocol information from the ethernet header

Returns:

the protocol code

getNextProto

public int getNextProto(byte[] hdr,
                        int offset)

getPacketProtocol

public int getPacketProtocol()