1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
//! Capfile - Pure Rust crate for reading/writing pcap/pcapng files
//!
//! This crate provides zero-copy parsing of pcap and pcapng files with
//! support for packet dissection and writing capture files.
//!
//! # Features
//!
//! - **Zero-copy parsing**: Data is parsed without copying where possible,
//! making it efficient for large capture files
//! - **Both formats**: Supports legacy PCAP and modern PCAPNG formats
//! - **Packet dissection**: Built-in support for dissecting Ethernet, IPv4,
//! IPv6, TCP, UDP, ICMP, and DNS protocols
//! - **Write support**: Create new PCAP and PCAPNG files
//!
//! # Quick Start
//!
//! ## Reading a PCAP file
//!
//! ```ignore
//! use capfile::PcapReader;
//!
//! // Open a pcap file (requires std feature)
//! let mut reader = PcapReader::open("capture.pcap")?;
//!
//! // Iterate over packets
//! while let Some(pkt) = reader.next_packet()? {
//! println!("{} bytes at {}", pkt.len(), pkt.timestamp_ns());
//! }
//! ```
//!
//! ## Reading from bytes (no_std/WASM)
//!
//! ```ignore
//! use capfile::PcapReader;
//! use std::io::Cursor;
//!
//! let data = include_bytes!("capture.pcap");
//! let mut reader = PcapReader::from_reader(Cursor::new(data))?;
//!
//! while let Some(pkt) = reader.next_packet()? {
//! // Process packet
//! }
//! ```
//!
//! ## Reading a PCAPNG file
//!
//! ```ignore
//! use capfile::PcapngReader;
//! use capfile::format::pcapng::Block;
//!
//! let mut reader = PcapngReader::open("capture.pcapng")?;
//!
//! // Get interface information
//! for (i, iface) in reader.interfaces().iter().enumerate() {
//! println!("Interface {}: link_type={}", i, iface.link_type);
//! }
//!
//! // Iterate over blocks
//! while let Some(block) = reader.next_block()? {
//! match block {
//! Block::EnhancedPacket(epb) => {
//! println!("Packet: {} bytes", epb.captured_length);
//! }
//! Block::InterfaceStatistics(stats) => {
//! println!("Stats: {} packets", stats.packets_received);
//! }
//! _ => {}
//! }
//! }
//! ```
//!
//! ## Packet Dissection
//!
//! ```ignore
//! use capfile::{PcapReader, dissect::{Ethernet, Ipv4, Tcp}};
//!
//! let mut reader = PcapReader::open("capture.pcap")?;
//!
//! if let Some(pkt) = reader.next_packet()? {
//! // Dissect Ethernet
//! let eth = Ethernet::new(pkt.data())?;
//! println!("{} -> {}", format_mac(eth.src()), format_mac(eth.dst()));
//!
//! // Dissect IPv4
//! let ip = Ipv4::new(eth.payload())?;
//! println!("{} -> {}", ip.src_str(), ip.dst_str());
//!
//! // Dissect TCP
//! if let Ok(tcp) = Tcp::new(ip.payload()) {
//! println!("{} -> {}", tcp.src_port(), tcp.dst_port());
//! }
//! }
//! ```
//!
//! ## Writing a PCAP file
//!
//! ```ignore
//! use capfile::PcapWriter;
//!
//! let mut writer = PcapWriter::create("output.pcap", 1)?; // Ethernet
//!
//! // Write a packet
//! writer.write_packet(b"packet data", 1000000000, 100)?;
//! ```
//!
//! # Modules
//!
//! - [`error`] - Error types for operations
//! - [`format`] - File format parsing (PCAP and PCAPNG)
//! - [`reader`] - PCAP and PCAPNG readers
//! - [`writer`] - PCAP and PCAPNG writers
//! - `dissect` - Packet dissection for various protocols
pub use Error;
pub use PcapReaderMmap;
pub use ;
pub use ;