1. Go Deep
Feb. 22, 2014
Yasunobu Chiba
Contributor, Trema Project

2. Problem in developing OpenFlow
controller with Trema and Ruby
• Difficult to extract required data from received
packet
• Existing packet parsers such as Pio and Racket
only provide limited functionalities
• Implementing packet parser by myself is timeconsuming job
We need sophisticated and fully functional
packet parser in Ruby

3. Development strategy
• Easy to use
• Secure
• Support network protocols as many as
possible
• Easy to implement

4. Design
Ethernet frame
Application
Ruby Library
Guru
Ruby object
Convert parsed data
to Ruby object
Parsing result

5. Implementation
Ethernet frame
Application
ruby-wireshark
libwireshark
Ruby object
Convert dissection
tree to Ruby classes
and objects
Dissection tree

6. Usage
require ’wireshark’
parsed = Wireshark::Dissector.new(frame)
….

7. Available instance methods for parsed
data?
• I DON’T KNOW !!!
• Ruby library dynamically creates instance
methods based on dissection tree

8. Instance methods - examples
ans
ans.app_id
ans.rev_id
ans.sender_id
ans.seq_num
ans.team_id
ans?
arp
arp.dst_hw_mac
arp.dst_proto_ipv4
arp.hw_size
arp.hw_type
arp.isgratuitous
arp.isgratuitous?
arp.opcode
arp.proto_size
arp.proto_type
arp.src_hw_mac
arp.src_proto_ipv4
arp?
bjnp
bjnp.code
bjnp.id
bjnp.payload_len
bjnp.seq_no
bjnp.session_id
bjnp.type
bjnp?
bootp
bootp.cookie
bootp.file
bootp.flags
bootp.flags.bc
bootp.flags.bc?
bootp.flags.reserved
bootp.hops
bootp.hw_addr_padding
bootp.hw_len
bootp.hw_mac_addr
bootp.hw_type
bootp.id
bootp.ip_client
bootp.ip_relay
bootp.ip_server
bootp.ip_your
bootp.option_type
bootp.option_type.bootp_option_end
bootp.secs
bootp.server
bootp.text
bootp.text?
bootp.type
bootp?
browser
browser.command
browser.comment
browser.mb_server
browser.os_major
browser.os_minor
browser.period
browser.proto_major
browser.proto_minor
browser.server
browser.server_type
browser.server_type.apple
browser.server_type.apple?
browser.server_type.backup_controller
browser.server_type.backup_controller?
browser.server_type.browser_backup
browser.server_type.browser_backup?
browser.server_type.browser_domain_master
browser.server_type.browser_domain_master?
browser.server_type.browser_master
browser.server_type.browser_master?
browser.server_type.browser_potential
browser.server_type.browser_potential?
browser.server_type.dfs
browser.server_type.dfs?
browser.server_type.dialin
browser.server_type.dialin?
browser.server_type.domain_controller
browser.server_type.domain_controller?
browser.server_type.domainenum
browser.server_type.domainenum?
browser.server_type.local
browser.server_type.local?
browser.server_type.member
browser.server_type.member?
browser.server_type.novell
browser.server_type.novell?
browser.server_type.nts
browser.server_type.nts?
browser.server_type.ntw
browser.server_type.ntw?
browser.server_type.osf
browser.server_type.osf?
browser.server_type.print
browser.server_type.print?
browser.server_type.server
browser.server_type.server?
browser.server_type.sql
browser.server_type.sql?
browser.server_type.time
browser.server_type.time?
browser.server_type.vms
browser.server_type.vms?
browser.server_type.w95
browser.server_type.w95?
browser.server_type.wfw
browser.server_type.wfw?
browser.server_type.workstation
browser.server_type.workstation?

9. Demo?

10. Future work
• Support packet reassembling
• Refactor, clean up, and open up the code !