Crate packet_dissector 

packet-dissector

A Rust crate for zero-copy parsing of layered network packets with registry-based protocol chaining. Protocol dissectors can be registered and chained to parse layered packets from L2 through L7.

Features

• Zero-copy parsing — works directly on &[u8] slices
• Extensible — add new protocols by implementing the dissector::Dissector trait
• Layered — automatic chaining from Ethernet → IP → TCP/UDP → Application
• Safe Rust — minimal unsafe (lifetime extension in the registry only, with // SAFETY: comments)
• Modular — enable only the protocols you need via feature flags

DissectorRegistry::default() registers all built-in protocol dissectors. See its documentation for the full list.

Quick Start

use packet_dissector::registry::DissectorRegistry;
use packet_dissector::packet::DissectBuffer;
use packet_dissector::field::FieldValue;

// Build a registry with all built-in dissectors
let registry = DissectorRegistry::default();

// An Ethernet + IPv4 + UDP packet (minimal example)
let packet_bytes: &[u8] = &[
    // Ethernet header (14 bytes)
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // dst MAC
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // src MAC
    0x08, 0x00,                         // EtherType: IPv4
    // IPv4 header (20 bytes)
    0x45, 0x00, 0x00, 0x1c,             // ver, ihl, len=28
    0x00, 0x00, 0x00, 0x00,             // id, flags, frag
    0x40, 0x11, 0x00, 0x00,             // ttl=64, proto=UDP, checksum
    0x0a, 0x00, 0x00, 0x01,             // src: 10.0.0.1
    0x0a, 0x00, 0x00, 0x02,             // dst: 10.0.0.2
    // UDP header (8 bytes)
    0x30, 0x39, 0x00, 0x50,             // src=12345, dst=80
    0x00, 0x08, 0x00, 0x00,             // len=8, checksum
];

let mut buf = DissectBuffer::new();
registry.dissect(packet_bytes, &mut buf).unwrap();
assert_eq!(buf.layers().len(), 3); // Ethernet, IPv4, UDP
assert_eq!(buf.layers()[0].name, "Ethernet");
assert_eq!(buf.layers()[1].name, "IPv4");
assert_eq!(buf.layers()[2].name, "UDP");

// Look up layers by name
let udp = buf.layer_by_name("UDP").unwrap();
let src_port = buf.field_by_name(udp, "src_port").unwrap();
assert_eq!(src_port.value, FieldValue::U16(12345));

Modules

dissector

Dissector trait and related types.

dissectors

Re-exports of built-in protocol dissector crates.

error

Error types for packet dissection.

field

Field value types for representing parsed protocol fields.

packet

Packet, layer, and dissect buffer representations.

registry

Dissector registry for managing and dispatching protocol dissectors.