WireForge

A pure Rust network packet processing library — a complete replacement for libpnet.

Architecture

wireforge-core       (Zero-copy parsers, builders, types, checksums)
├── wireforge-packet  (Unified Packet enum and L2–L4 dispatch)
├── wireforge-app     (Application-layer protocols and pcap I/O)
└── wireforge-io      (Cross-platform raw socket I/O)

wireforge-app provides its own [AppPacket] enum for application-layer protocol dispatch. It intentionally does not depend on wireforge-packet, keeping the two dispatch layers independent.

Quick Start

cargo add wireforge-core wireforge-packet wireforge-io wireforge-app

// Parse an Ethernet frame
use wireforge_core::ether::EthernetPacket;
let eth = EthernetPacket::new(&frame_bytes).unwrap();
println!("EtherType: {:?}", eth.ethertype());

// Build a DNS query
use wireforge_app::dns::builder::DnsPacketBuilder;
use wireforge_app::dns::types::{DnsType, DnsClass};
let query = DnsPacketBuilder::query()
    .add_question("example.com", DnsType::A, DnsClass::IN)
    .build();

// Capture packets (cross-platform)
use wireforge_io::{DefaultL2Reader, traits::L2Reader};
let mut rx = DefaultL2Reader::new("eth0")?;
let eth = rx.recv()?;

Application-layer dispatch

use wireforge_app::{AppPacket, app_packet::{parse_tcp_application, parse_udp_application}};

// Classify a TCP payload by port
if let Some(pkt) = parse_tcp_application(tcp_payload, src_port, 443) {
    println!("{}: {:?}", pkt.protocol_name(), pkt);
}

// Classify a UDP payload by port
if let Some(pkt) = parse_udp_application(udp_payload, src_port, 5353) {
    println!("{}: {:?}", pkt.protocol_name(), pkt);
}

Protocol Coverage

Platform Support

Migrating from libpnet

WireForge is a drop-in replacement for libpnet. See the Migration Guide for detailed API comparison and code examples.

Community

• Contributing Guide
• Security Policy
• Changelog

License

MIT