Timestamp option

www.networksorcery.com/enp/protocol/tcp/option008.htm

Methods
D
E
N
Class Public methods
new(args={})

Source: show 

# File lib/packetfu/protos/tcp.rb, line 495
                        def initialize(args={})
                                super(
                                        args.merge(:kind => 8,
                                                                                 :optlen => 10
                                                                                )
                                )
                                self[:value] = StructFu::String.new.read(args[:value] || "\x00" * 8) 
                        end
Instance Public methods
decode()

TS options with lengths other than 10 are malformed.

Source: show 

# File lib/packetfu/protos/tcp.rb, line 505
                        def decode
                                if self[:optlen].to_i == 10
                                        val1,val2 = self[:value].unpack("NN")
                                        "TS:#{val1};#{val2}"
                                else
                                        "TS-bad:#{self[:value]}"
                                end
                        end
encode(str)

TS options are in the format of “TS:[timestamp value];[timestamp secret]” Both should be written as decimal numbers.

Source: show 

# File lib/packetfu/protos/tcp.rb, line 516
                        def encode(str)
                                if str =~ /^([0-9]+);([0-9]+)$/
                                        tsval,tsecr = str.split(";").map {|x| x.to_i}
                                        if tsval <= 0xffffffff && tsecr <= 0xffffffff
                                                self[:value] = StructFu::String.new([tsval,tsecr].pack("NN"))
                                        else
                                                self[:value] = StructFu::String.new(str)
                                        end
                                else
                                        self[:value] = StructFu::String.new(str)
                                end
                        end