at.jku.fim.rubanetra.pcap

Class PcapActivity

java.lang.Object

java.util.EventObject

at.jku.fim.rubanetra.protocol.activity.AbstractActivity

at.jku.fim.rubanetra.protocol.activity.AbstractReplaceableActivity

at.jku.fim.rubanetra.pcap.PcapActivity

All Implemented Interfaces:

CsvRecordOutputWriter, Activity, ReplaceableActivity, Serializable

public class PcapActivity
extends AbstractReplaceableActivity

A PcapActivity may be interpreted as a Network Layer 1 activity type, because all common PCAP-Files contain individual Pcap-entries which are wrapped by this class in order to provide PCAP-specific metadata per entry. This class currently supports the JNetPcap library only (which in turn relies on the native libpcap library), however, if the limited Kraken-Pcap-Parser has to be used, consider converting the Kraken-specific Pcap packet to a JMemoryPacket in a manner similar to the following (at your own risk):

byte[] arr = new byte[getPcapPacket().getPacketData().readableBytes()];

new ChainBuffer(getPcapPacket().getPacketData()).gets(arr);

JMemoryPacket jPacket = new JMemoryPacket(arr);

jPacket.scan(Ethernet.ID);

Ethernet header = jPacket.getHeader(new Ethernet());

If a JNetPcap specific PcapPacket must be passed to a Kraken parser, the class PcapPacketToKrakenPcapPacketAdapter may be useful.

See Also:

PcapPacketToKrakenPcapPacketAdapter, Serialized Form

Field Summary

Fields inherited from class at.jku.fim.rubanetra.protocol.activity.AbstractActivity

PROPERTY_ADD_FRAME_NUMBERS, PROPERTY_NEW_END_INSTANT, PROPERTY_NEW_START_INSTANT

Fields inherited from class java.util.EventObject

source

Constructor Summary

Constructors

Constructor and Description
PcapActivity(long frameNumber, org.jnetpcap.packet.PcapPacket pcapPacket) Create a new PcapActivity using the provided frame number (as seen by the PcapFileHandler) and the JNetPcap specific PCAP packet.

Method Summary

Modifier and Type	Method and Description
Collection<Long>	getCompoundFrameNumbers() This method returns a sorted collection of all frame numbers in consecutive order and greater than zero, that define this activity.
long	getFrameNumber()
org.jnetpcap.packet.PcapPacket	getPcapPacket()
java.time.Instant	getPcapTimestamp()
String	toString()

Methods inherited from class at.jku.fim.rubanetra.protocol.activity.AbstractReplaceableActivity

isReplaced, replaceActivity, setReplaced

Methods inherited from class at.jku.fim.rubanetra.protocol.activity.AbstractActivity

addOptionalField, addPropertyChangeListener, addPropertyChangeListener, extendActivity, getActivityType, getDescription, getDestinationAddressAsString, getEndInstant, getEndTimestamp, getOptionalFields, getSourceAddressAsString, getStartInstant, getStartTimestamp, isExcludedFromOutput, removePropertyChangeListener, removePropertyChangeListener, removeReplacedActivity, setDescription, setDestinationAddress, setEndInstant, setExcludedFromOutput, setSourceAddress, setStartInstant, writeCsvRecord

Methods inherited from class java.util.EventObject

getSource

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface at.jku.fim.rubanetra.protocol.activity.Activity

addPropertyChangeListener, addPropertyChangeListener, getActivityType, getDescription, getDestinationAddressAsString, getEndInstant, getEndTimestamp, getOptionalFields, getSourceAddressAsString, getStartInstant, getStartTimestamp, isExcludedFromOutput, removePropertyChangeListener, removePropertyChangeListener, setExcludedFromOutput

Constructor Detail

PcapActivity

public PcapActivity(long frameNumber,
                    org.jnetpcap.packet.PcapPacket pcapPacket)

Create a new PcapActivity using the provided frame number (as seen by the PcapFileHandler) and the JNetPcap specific PCAP packet.

Parameters:

frameNumber - the frame number of the packet, reconstructed by the PcapFileHandler

pcapPacket - the JNetPcap specific PCAP packet representation

Method Detail

getPcapPacket

public org.jnetpcap.packet.PcapPacket getPcapPacket()

Returns:

The JNetPcap specific representation of this packet capture activity

getFrameNumber

public long getFrameNumber()

Returns:

the frame number of this packet capture activity as reconstructed by the used PcapHandler

getPcapTimestamp

public java.time.Instant getPcapTimestamp()

Returns:

The Java 8 specific Instant in time, which was built from the JNetPcap specific timestamp information.

See Also:

PcapPacket.getCaptureHeader()

getCompoundFrameNumbers

public Collection<Long> getCompoundFrameNumbers()

Description copied from interface: Activity

This method returns a sorted collection of all frame numbers in consecutive order and greater than zero, that define this activity. It serves as basis for a manual review of the packets that were used during the reasoning process, i.e. a future use case could consist of using these numbers to extract all frames corresponding to a single activity individually from a potentially large PCAP file.

Specified by:

getCompoundFrameNumbers in interface Activity

Overrides:

getCompoundFrameNumbers in class AbstractActivity

Returns:

a sorted collection of all frame numbers in consecutive order and greater than zero, that define this activity

toString

public String toString()

Overrides:

toString in class AbstractActivity