packrat-tui 0.3.2

A Wireshark-style terminal packet analyzer, reverse engineering, and security research tool with live capture, IDS, port scanner, packet crafter, and PCAP replay
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

#[cfg(feature = "real-capture")]
use pcap::Capture;

use std::time::Instant;
use tokio::sync::mpsc::Sender;
use tokio::task::JoinHandle;

use crate::capture::CaptureSource;
use crate::net::packet::Packet;
use crate::net::parser::parse_ethernet;

pub struct LiveCapture {
    pub iface: String,
    pub filter: Option<String>,
}

impl CaptureSource for LiveCapture {
    fn run(self, tx: Sender<Packet>) -> JoinHandle<()> {
        // pcap is a blocking API — run it on a dedicated blocking thread.
        tokio::task::spawn_blocking(move || {
            #[cfg(feature = "real-capture")]
            {
                let mut cap = Capture::from_device(self.iface.as_str())
                    .expect("device not found")
                    .promisc(true)
                    .snaplen(65535)
                    .timeout(100)
                    .open()
                    .expect("failed to open device (root / Administrator required)");

                if let Some(ref f) = self.filter {
                    cap.filter(f, true).expect("invalid BPF filter");
                }

                let start = Instant::now();
                let mut counter = 0u64;

                while let Ok(raw) = cap.next_packet() {
                    let ts = start.elapsed().as_secs_f64();
                    let pkt = parse_ethernet(raw.data, counter + 1, ts);
                    counter += 1;
                    if tx.blocking_send(pkt).is_err() {
                        break;
                    }
                }
            }

            #[cfg(not(feature = "real-capture"))]
            {
                let _ = (self, tx);
            }
        })
    }
}