Struct ParsedFrame 

pub struct ParsedFrame<'a> { /* private fields */ }

A parsed ethernet frame with convenient accessors for policy matching.

Wraps etherparse::SlicedPacket for zero-copy header inspection. Supports Ethernet II, ARP, IPv4, IPv6, TCP, UDP, ICMPv4, and ICMPv6 (including NDP) via etherparse.

Implementations

impl<'a> ParsedFrame<'a>

pub fn parse(raw: &'a [u8]) -> Option<Self>

Parse an ethernet frame. Returns None if the frame is malformed.

pub fn raw(&self) -> &'a [u8]

Get the raw frame bytes.

pub fn sliced(&self) -> &SlicedPacket<'a>

Get the inner SlicedPacket for direct access to etherparse types.

pub fn ethertype(&self) -> Option<u16>

Get the EtherType as a raw u16.

pub fn is_arp(&self) -> bool

Returns true if the frame is an ARP packet.

pub fn is_ndp(&self) -> bool

Returns true if the frame is an IPv6 NDP (Neighbor Discovery) message.

NDP uses ICMPv6 types 133–137: Router Solicitation, Router Advertisement, Neighbor Solicitation, Neighbor Advertisement, and Redirect.

pub fn src_mac(&self) -> Option<[u8; 6]>

Get the source MAC address (6 bytes).

pub fn dst_mac(&self) -> Option<[u8; 6]>

Get the destination MAC address (6 bytes).

pub fn src_ip(&self) -> Option<IpAddr>

Get the source IP address.

pub fn dst_ip(&self) -> Option<IpAddr>

Get the destination IP address.

pub fn protocol(&self) -> Option<IpProtocol>

Get the IP protocol.

pub fn src_port(&self) -> Option<u16>

Get the source port (TCP or UDP).

pub fn dst_port(&self) -> Option<u16>

Get the destination port (TCP or UDP).

pub fn is_dns(&self) -> bool

Returns true if this is a DNS packet (UDP or TCP to/from port 53).

pub fn payload(&self) -> &'a [u8]

Get the transport-layer payload (e.g. DNS wire data).

For TCP/UDP, returns the data after the transport header. For other protocols, returns the IP payload.