#------------------------------------------------------------------------- # Packet Lengths # Chart Packet Length distribution in capture file # # Unsniff Network Analyzer scripting sample. # For more scripts visit : # http://www.unleashnetworks.com/devzone/unsniff/script-library.html # #---------------------------------------------------------------------------- require 'rubygems' require 'win32ole' require 'fox16' include Fox require_relative 'unleashcharts' include UnleashCharts class ChartWindow < FXMainWindow def initialize(theapp) # base class super(theapp, "Packet Length Distribution", nil, nil, DECOR_ALL, 0,0,800,300) # single horizontal panel @contents = FXHorizontalFrame.new(self, LAYOUT_SIDE_TOP|LAYOUT_FILL_X|LAYOUT_FILL_Y,0,0,0,0,0,0,0,0,0) # vertical frame @canvasFrame = FXVerticalFrame.new(@contents, LAYOUT_FILL_X|LAYOUT_FILL_Y|LAYOUT_TOP|LAYOUT_LEFT, 0,0,0,0,10,10,10,10) # label above canvas @label = FXLabel.new(@canvasFrame, "Distribution of packet lengths", nil, JUSTIFY_CENTER_X|LAYOUT_FILL_X) # divider FXHorizontalSeparator.new(@canvasFrame) # actual canvas (whew!) @canvas = UnBarChart.new(@canvasFrame) end def create super show(PLACEMENT_SCREEN) end def setModel (mod) @canvas.model = mod end end class PacketLengthBuckets attr_reader :barcount, :maxval def initialize(maxpacketsize,granularity) @maxPacketSize = maxpacketsize @gran = granularity @bucket = Array.new(maxpacketsize/granularity) @bucket.fill(0) @barcount = @bucket.length + 1 @maxval = 100 @overlimit = 0 end def loadCaptureFile(filename) unsniffDB = WIN32OLE.new("Unsniff.Database") unsniffDB.OpenForRead(filename) packetIndex = unsniffDB.PacketIndex (0..packetIndex.Count-1).each do |idx| pkt = packetIndex.Item(idx) if pkt.Length <= @maxPacketSize bucketid = pkt.Length / @gran @bucket[bucketid] += 1 else @overlimit += 1 end end @maxval = packetIndex.Count unsniffDB.Close end def dumpContents @bucket.each_index do |idx| bitem = @bucket[idx] print " [#{idx}]\t #{bitem}\n" end print " Over \t #{@overlimit}\n" end def each_label_x (0..@bucket.length-1).each do |idx| from = idx * @gran to = (idx+1) * @gran labtext = "< #{to}" labval = idx yield labtext, labval end yield ">#{@maxPacketSize}", @bucket.length end def each_val (0..@bucket.length-1).each do |idx| value_y = @bucket[idx] yield idx, value_y end yield @bucket.length, @overlimit end end USAGE = "lendist " if ARGV.length != 1 puts USAGE exit 1 end lenBuckets = PacketLengthBuckets.new(2000,100) lenBuckets.loadCaptureFile(ARGV[0]) lenBuckets.dumpContents # A new Fox Application and MainWindow object theApp = FXApp.new theMainWindow = ChartWindow.new(theApp) theMainWindow.setModel(lenBuckets) # Run application theApp.create theMainWindow.show theApp.run