Struct pcap_parser::LegacyPcapReader

pub struct LegacyPcapReader<R> where
    R: Read,  { /* fields omitted */ }

Parsing iterator over legacy pcap data (streaming version)

This iterator a streaming parser based on a circular buffer, so any input providing the Read trait can be used.

The first call to next will return the file header. Some information of this header must be stored (for ex. the data link type) to be able to parse following block contents. Following calls to next will always return legacy data blocks.

The size of the circular buffer has to be big enough for at least one complete block. Using a larger value (at least 65k) is advised to avoid frequent reads and buffer shifts.

There are precautions to take when reading multiple blocks before consuming data. See PcapReaderIterator for details.

use pcap_parser::*;
use pcap_parser::traits::PcapReaderIterator;
use std::fs::File;
use std::io::Read;

let mut file = File::open(path).unwrap();
let mut num_blocks = 0;
let mut reader = LegacyPcapReader::new(65536, file).expect("LegacyPcapReader");
loop {
    match reader.next() {
        Ok((offset, block)) => {
            println!("got new block");
            num_blocks += 1;
            match block {
                PcapBlockOwned::LegacyHeader(_hdr) => {
                    // save hdr.network (linktype)
                },
                PcapBlockOwned::Legacy(_b) => {
                    // use linktype to parse b.data()
                },
                PcapBlockOwned::NG(_) => unreachable!(),
            }
            reader.consume(offset);
        },
        Err(PcapError::Eof) => break,
        Err(PcapError::Incomplete) => {
            reader.refill().unwrap();
        },
        Err(e) => panic!("error while reading: {:?}", e),
    }
}
println!("num_blocks: {}", num_blocks);

Methods

impl<R> LegacyPcapReader<R> where
    R: Read, 

pub fn new(capacity: usize, reader: R) -> Result<LegacyPcapReader<R>, PcapError>

pub fn from_buffer(
    buffer: Buffer,
    reader: R
) -> Result<LegacyPcapReader<R>, PcapError>

Trait Implementations

impl<R> PcapReaderIterator<R> for LegacyPcapReader<R> where
    R: Read, 

fn next(&mut self) -> Result<(usize, PcapBlockOwned), PcapError>

Get the next pcap block, if possible. Returns the number of bytes read and the block.

fn consume(&mut self, offset: usize)

Consume data, and refill buffer if needed.

fn consume_noshift(&mut self, offset: usize)

Consume date, but do not change the buffer. Blocks already read are still valid.

fn refill(&mut self) -> Result<(), PcapError>

Refill the internal buffer, shifting it if necessary.

fn position(&self) -> usize

Get the position in the internal buffer. Can be used to determine if refill is required.

fn grow(&mut self, new_size: usize) -> bool

Grow size of the internal buffer.