Crate pcarp

pcarp is a pure-Rust library for reading pcap-ng files.

• Correct: Agrees with tshark across a broad test suite.
• Fast: Zero-copy. Performance is comparable to libpcap.
• Flexible input: Takes anything which implements Read.
• Flexible output: exposes a streaming-iterator-style API.
• Reliable: No panics, even on malformed input.

See the README for more details.

The entry point is Capture.

Example

let file = File::open("integration_tests/10_sqldeveloper10_2016.pcapng.xz").unwrap();
let uncompressed = xz2::read::XzDecoder::new(file);
let mut pcap = Capture::new(uncompressed).unwrap();

while let Some(pkt) = pcap.next() {
    let pkt = pkt.unwrap();
    println!("{:?} {}", pkt.timestamp, pkt.data.len());
}

Modules

block

Block definitions. Not meant for consumption.

Structs

Capture	A packet capture which can be iterated over.
Interface	A network interface.
Packet	A single captured packet.

Enums

Error
LinkType	The type of physical link backing a network interface.