pktscope 0.1.0

A Wireshark-style terminal packet analyzer — lightweight, keyboard-driven, scriptable Wireshark alternative for the terminal
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

use std::net::IpAddr;

#[derive(Debug, Clone, PartialEq)]
pub enum FilterExpr {
    ProtocolPresent(ProtocolAtom),
    Comparison {
        field: FieldPath,
        op: CompareOp,
        value: FilterValue,
    },
    Contains {
        field: FieldPath,
        pattern: String,
    },
    And(Box<FilterExpr>, Box<FilterExpr>),
    Or(Box<FilterExpr>, Box<FilterExpr>),
    Not(Box<FilterExpr>),
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ProtocolAtom {
    Ethernet,
    Arp,
    Ip,
    Ipv4,
    Ipv6,
    Tcp,
    Udp,
    Icmp,
    Icmpv6,
    Dns,
    Tls,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct FieldPath {
    pub segments: Vec<String>,
}

impl FieldPath {
    pub fn as_str(&self) -> String {
        self.segments.join(".")
    }
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum CompareOp {
    Eq,
    Ne,
}

#[derive(Debug, Clone, PartialEq)]
pub enum FilterValue {
    Integer(i64),
    IpAddr(IpAddr),
    Str(String),
}