1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
//! # pcap-frame-parser
//!
//! A small, dependency-light parser for network capture files and the
//! frames inside them. It handles two capture container formats —
//! legacy PCAP and PCAPng — and dissects the resulting Ethernet frames
//! down through VLAN tags, IPv4, and UDP/TCP, handing back the raw
//! transport payload for a protocol-specific parser (DNS, DHCP, OSPF,
//! whatever you're decoding) to take from there.
//!
//! It does not link against `libpcap`/`npcap` and has no `unsafe` code;
//! it's pure Rust plus [`nom`] for the IPv4/PCAP binary parsing.
//!
//! ## Scope
//!
//! - **Containers:** legacy PCAP ([`pcap`]) and PCAPng ([`pcapng`]).
//! - **Frames:** Ethernet II, optional single 802.1Q VLAN tag, optional
//! double-tagged 802.1ad "Q-in-Q" framing, IPv4, UDP, TCP
//! ([`ethernet`]).
//! - **Out of scope:** IPv6, live capture, writing capture files. If you
//! need those, this crate is not (yet) for you.
//!
//! ## Example
//!
//! ```
//! use pcap_frame_parser::{pcap, ethernet};
//!
//! # let capture_bytes: &[u8] = &[
//! # 0xd4, 0xc3, 0xb2, 0xa1, 2, 0, 4, 0, 0,0,0,0, 0,0,0,0, 0xff,0xff,0,0, 1,0,0,0,
//! # ];
//! let (header, packets) = pcap::iter_packets(capture_bytes)?;
//! for packet in &packets {
//! if let Some((ip_header, ip_payload)) = ethernet::extract_ip(packet.data) {
//! if ip_header.protocol == ethernet::PROTO_UDP {
//! if let Some((src_port, dst_port, payload)) = ethernet::extract_udp(ip_payload) {
//! // hand `payload` off to a DNS/DHCP/whatever parser
//! let _ = (src_port, dst_port, payload);
//! }
//! }
//! }
//! }
//! # let _ = header;
//! # Ok::<(), String>(())
//! ```