# Ruby/pcap with threads **URL:** \ **Category:** ruby-talk\ **Created:** [16 November 2007 05:45 UTC](https://rubytalk.org/t/ruby-pcap-with-threads/42238 "2007-11-16T05:45:05Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![kenny\_roytman](https://avatars.discourse-cdn.com/v4/letter/k/958977/32.png) [@kenny\_roytman](https://rubytalk.org/u/kenny_roytman)\ **Post date:** [16 November 2007 05:45 UTC](https://rubytalk.org/t/ruby-pcap-with-threads/42238/1 "2007-11-16T05:45:05Z")
Hi Everyone, Can someone please explain why I don't see any output from the following code? I'm stumped. By the way, "en1" is the name of my network device. Thanks. code:       1 require 'pcaplet'       2       3 include Pcap       4       5       6 x = Thread.new {       7 pcaplet = Pcaplet.new("-i en1")       8       9 pcaplet.each\_packet { |pkt|      10 puts "#{pkt.src.to\_num\_s}:#{pkt.sport} #{pkt.dst.to\_num\_s}:#{pkt.dport}" if pkt.ip?      11 }      12      13 }      14      15 x.join      16 ---
**Author:** ![\_Pena\_Botp1](https://avatars.discourse-cdn.com/v4/letter/_/94ad74/32.png) [@\_Pena\_Botp1](https://rubytalk.org/u/_Pena_Botp1)\ **Post date:** [16 November 2007 08:05 UTC](https://rubytalk.org/t/ruby-pcap-with-threads/42238/2 "2007-11-16T08:05:28Z")
# Hi Everyone, # Can someone please explain why I don't see any output from the # following code? I'm stumped. By the way, "en1" is the name of my # network device. Thanks. > **···** > > From: kenny roytman [[mailto:kenny.roytman@gmail.com](mailto:kenny.roytman@gmail.com)] > # > # code: > # 1 require 'pcaplet' > # 2 > # 3 include Pcap > # 4 > # 5 > # 6 x = Thread.new { > # 7 pcaplet = Pcaplet.new("-i en1") > # 8 > # 9 pcaplet.each\_packet { |pkt| > # 10 puts "#{pkt.src.to\_num\_s}:#{pkt.sport} > # #{pkt.dst.to\_num\_s}:#{pkt.dport}" if pkt.ip? > # 11 } > # 12 > # 13 } > # 14 > # 15 x.join > # 16 > > i simplified your code, but it works.. > pcaplet is quite old, you might try modifying some to remove deprecation warnings... > > botp@pc4all:~/pcap$ cat test.rb > require 'pcaplet' > include Pcap > x = Thread.new { >   pcaplet = Pcaplet.new("-i eth0") >   pcaplet.each\_packet { |pkt| >     puts pkt >   } > } > x.join > > botp@pc4all:~/pcap$ sudo ruby test.rb > /usr/local/lib/ruby/site\_ruby/1.8/i686-linux/pcap.so: warning: do not use Fixnums as Symbols > /usr/local/lib/ruby/site\_ruby/1.8/i686-linux/pcap.so: warning: do not use Fixnums as Symbols > /usr/local/lib/ruby/site\_ruby/1.8/i686-linux/pcap.so: warning: do not use Fixnums as Symbols > 10.2.87.95:6771 \> 239.192.152.143:6771 len 127 sum 35035 > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A.... > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A.... > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A.... > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A.... > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A.... > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A.... > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > \ > > kind regards -botp ---
**Author:** ![kenny\_roytman](https://avatars.discourse-cdn.com/v4/letter/k/958977/32.png) [@kenny\_roytman](https://rubytalk.org/u/kenny_roytman)\ **Post date:** [16 November 2007 15:55 UTC](https://rubytalk.org/t/ruby-pcap-with-threads/42238/3 "2007-11-16T15:55:03Z")
wierd, i'm not seeing this behavior. I'm running on Mac OS X. I wonder if that's a problem ... > **···** > > On Nov 16, 2:05 am, Peña, Botp \ wrote: > > > From: kenny roytman [mailto:kenny.royt...@gmail.com] > > # Hi Everyone, > > # Can someone please explain why I don't see any output from the > > # following code? I'm stumped. By the way, "en1" is the name of my > > # network device. Thanks. > > # > > # code: > > # 1 require 'pcaplet' > > # 2 > > # 3 include Pcap > > # 4 > > # 5 > > # 6 x = Thread.new { > > # 7 pcaplet = Pcaplet.new("-i en1") > > # 8 > > # 9 pcaplet.each\_packet { |pkt| > > # 10 puts "#{pkt.src.to\_num\_s}:#{pkt.sport} > > # #{pkt.dst.to\_num\_s}:#{pkt.dport}" if pkt.ip? > > # 11 } > > # 12 > > # 13 } > > # 14 > > # 15 x.join > > # 16 > > > > i simplified your code, but it works.. > > pcaplet is quite old, you might try modifying some to remove deprecation warnings... > > > > botp@pc4all:~/pcap$ cat test.rb > > require 'pcaplet' > > include Pcap > > x = Thread.new { > >   pcaplet = Pcaplet.new("-i eth0") > >   pcaplet.each\_packet { |pkt| > >     puts pkt > >   }} > > > > x.join > > > > botp@pc4all:~/pcap$ sudo ruby test.rb > > /usr/local/lib/ruby/site\_ruby/1.8/i686-linux/pcap.so: warning: do not use Fixnums as Symbols > > /usr/local/lib/ruby/site\_ruby/1.8/i686-linux/pcap.so: warning: do not use Fixnums as Symbols > > /usr/local/lib/ruby/site\_ruby/1.8/i686-linux/pcap.so: warning: do not use Fixnums as Symbols > > 10.2.87.95:6771 \> 239.192.152.143:6771 len 127 sum 35035 > > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > > 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A.... > > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > > 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A.... > > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > > 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A.... > > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > > 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A.... > > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > > 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A.... > > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > > 10.2.10.123:2048 \> pc4all.bugo.dmpi:22 .A.... > > pc4all.bugo.dmpi:22 \> 10.2.10.123:2048 .AP... > > \ > > > > kind regards -botp ---
**Author:** ![Eric\_Hodel1](https://avatars.discourse-cdn.com/v4/letter/e/a9adbd/32.png) [@Eric\_Hodel1](https://rubytalk.org/u/Eric_Hodel1)\ **Post date:** [17 November 2007 03:26 UTC](https://rubytalk.org/t/ruby-pcap-with-threads/42238/4 "2007-11-17T03:26:13Z")
I had to go with a fork model for OS X, something in pcap doesn't allow switching threads. See Capture#run for a stupid-simple way of doing this: [http://segment7.net/projects/ruby/snippets/httpdump.rb](http://segment7.net/projects/ruby/snippets/httpdump.rb) If you need better communication, instead of parsing #inspect output, use Marshal.dump and Marshal.load. > **···** > > On Nov 16, 2007, at 07:55 , kenny roytman wrote: > > > wierd, i'm not seeing this behavior. I'm running on Mac OS X. I > > wonder if that's a problem ... > > -- > Poor workers blame their tools. Good workers build better tools. The > best workers get their tools to do the work for them. -- Syndicate Wars