pktmon 0.6.2

A library for capturing network packets on Windows using the PktMon service
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

use pktmon::EtlCapture;
use std::env;

fn main() {
    colog::default_builder()
        .filter_level(log::LevelFilter::Debug)
        .init();

    // Get file path from command line argument
    let args: Vec<String> = env::args().collect();
    if args.len() < 2 {
        eprintln!("Usage: {} <path-to-etl-file>", args[0]);
        std::process::exit(1);
    }

    let etl_path = &args[1];
    println!("Reading packets from ETL file: {}", etl_path);

    // Create ETL capture reader
    let mut etl_capture = match EtlCapture::new(etl_path) {
        Ok(capture) => capture,
        Err(e) => {
            eprintln!("Failed to create ETL capture: {}", e);
            std::process::exit(1);
        }
    };

    // Process all packets
    match etl_capture.packets() {
        Ok(packets) => {
            println!("Successfully read {} packets from ETL file", packets.len());

            // Print packet information
            for (i, packet) in packets.iter().enumerate() {
                let type_str = match &packet.payload {
                    pktmon::PacketPayload::Unknown(_) => "Unknown",
                    pktmon::PacketPayload::Ethernet(_) => "Ethernet",
                    pktmon::PacketPayload::WiFi(_) => "WiFi",
                    pktmon::PacketPayload::IP(_) => "IP",
                    pktmon::PacketPayload::HTTP(_) => "HTTP",
                    pktmon::PacketPayload::TCP(_) => "TCP",
                    pktmon::PacketPayload::UDP(_) => "UDP",
                    pktmon::PacketPayload::ARP(_) => "ARP",
                    pktmon::PacketPayload::ICMP(_) => "ICMP",
                    pktmon::PacketPayload::ESP(_) => "ESP",
                    pktmon::PacketPayload::AH(_) => "AH",
                    pktmon::PacketPayload::L4Payload(_) => "L4Payload",
                };
                let payload = packet.payload.to_vec();
                println!("Packet [{}] #{}: {} bytes", type_str, i + 1, payload.len());

                // Print first 32 bytes of payload as hex dump
                if !payload.is_empty() {
                    println!("  First 32 bytes:");
                    let bytes_to_show = std::cmp::min(32, payload.len());
                    for (i, byte) in payload[..bytes_to_show].iter().enumerate() {
                        print!("{:02x} ", byte);
                        if (i + 1) % 16 == 0 {
                            println!();
                        }
                    }
                    println!();
                }
            }
        }
        Err(e) => {
            eprintln!("Failed to process ETL file: {}", e);
            std::process::exit(1);
        }
    }
}