Module pcap_parser::pcap

PCAP file format

See https://wiki.wireshark.org/Development/LibpcapFileFormat for details.

There are 2 main ways of parsing a PCAP file. The first method is to use parse_pcap. This method requires to load the entire file to memory, and thus may not be good for large files.

The PcapCapture implements the Capture trait to provide generic methods. However, this trait also reads the entire file.

The second method is to first parse the PCAP header using parse_pcap_header, then loop over parse_pcap_frame to get the data. This can be used in a streaming parser.

Structs

• LegacyPcapBlock
  Container for network data in legacy Pcap files
• PcapHeader
  PCAP global header

Functions

• parse_pcap_frame
  Read a PCAP record header and data
• parse_pcap_frame_be
  Read a PCAP record header and data (big-endian)
• parse_pcap_header
  Read the PCAP global header