Struct PcapSink 

pub struct PcapSink<W> { /* private fields */ }

A pcap stream framer that writes captured packets to a writer in Go-Tailscale-faithful classic pcap (USER0 link type + a 4-byte path preamble per record). Construct with PcapSink::new (which emits the global header), then call PcapSink::log_packet per packet.

Records are not flushed per packet (that would be a syscall on every packet on the single dataplane thread). For buffering, wrap writer in a std::io::BufWriter; buffered records are flushed when the writer is dropped (on capture stop), or call PcapSink::flush periodically if a reader needs to tail the stream promptly.

Implementations

impl<W: Write> PcapSink<W>

pub fn new(writer: W) -> Result<Self>

Create a sink and immediately write the 24-byte pcap global header.

pub fn log_packet(&mut self, path_code: u16, pkt: &[u8]) -> Result<()>

Frame and write one captured packet: the 16-byte record header, the 4-byte Tailscale path preamble, then the raw IP bytes. The timestamp is taken from the system clock now.

pub fn flush(&mut self) -> Result<()>

Flush the underlying writer. Optional: callers that need a reader tailing the stream (e.g. tcpdump -r on a growing file, or a live pipe) to see packets promptly can call this periodically — it is not called per record, so the hot path stays syscall-free. Buffered records are otherwise flushed when the writer is dropped on capture stop.