Struct PcapFlowSource 

pub struct PcapFlowSource<R: Read> { /* private fields */ }

Available on crate feature pcap only.

A pcap-backed source of PacketViews.

Wraps PcapReader from pcap-file and exposes ergonomic iterators that hand off to netring-flow.

Implementations

impl PcapFlowSource<BufReader<File>>

pub fn open(path: impl AsRef<Path>) -> Result<Self, Error>

Open a pcap file from disk.

impl<R: Read> PcapFlowSource<R>

pub fn from_reader(reader: R) -> Result<Self, Error>

Wrap any Read (e.g., Cursor<&[u8]> for tests).

pub fn views(self) -> ViewIter<R>

Iterate raw PacketViews. Each call yields the next packet or Err on a malformed record.

Note: each OwnedPacketView owns its data (we copy from the pcap reader because the underlying buffer is reused across next_packet calls). One alloc per packet — fine for offline analysis; not appropriate for sustained 1+ Gbps live replay.

pub fn with_extractor<E: FlowExtractor>(self, extractor: E) -> EventIter<R, E>

where E::Key: Clone,

One-step pipeline: feed every view through extractor and emit FlowEvents.

Constructs an internal FlowTracker with default config and () for per-flow user state. For non-default config or custom user state, drop down to the manual pattern:

use flowscope::pcap::PcapFlowSource;
use flowscope::{FlowTracker, FlowTrackerConfig};
use flowscope::extract::FiveTuple;
use std::time::Duration;

let mut tracker = FlowTracker::<FiveTuple>::with_config(
    FiveTuple::bidirectional(),
    FlowTrackerConfig {
        idle_timeout_tcp: Duration::from_secs(60),
        ..Default::default()
    },
);
for view in PcapFlowSource::open("trace.pcap")?.views() {
    for _evt in tracker.track(view?.as_view()) {
        // process
    }
}