# File lib/packetfu/packet.rb, line 16 def self.parse(packet,args={}) if packet.size >= 14 # Min size for Ethernet. No check for max size, yet. case packet[12,2] # Check the Eth protocol field. when "\x08\x00" # It's IP. case (packet[14,1][0] >> 4) # Check the IP version field. when 4; # It's IPv4. case packet[23,1] # Check the IP protocol field. when "\x06"; p = TCPPacket.new # Returns a TCPPacket. when "\x11"; p = UDPPacket.new # Returns a UDPPacket. when "\x01"; p = ICMPPacket.new # Returns an ICMPPacket. else; p = IPPacket.new # Returns an IPPacket since we can't tell the transport layer. end else; p = IPPacket.new # Returns an EthPacket since we don't know any other IP version. end when "\x08\x06" # It's arp if packet.size >= 28 # Min size for complete arp p = ARPPacket.new else; p = EthPacket.new # Returns an EthPacket since we can't deal with tiny arps. end when "\x86\xdd" # It's IPv6 if packet.size >= 54 # Min size for a complete IPv6 packet. p = IPv6Packet.new else; p = EthPacket.new # Returns an EthPacket since we can't deal with tiny Ipv6. end else; p = EthPacket.new # Returns an EthPacket since we can't tell the network layer. end else p = InvalidPacket.new # Not the right size for Ethernet (jumbo frames are okay) end parsed_packet = p.read(packet,args) return parsed_packet end