pcap_frame_parser/lib.rs
1//! # pcap-frame-parser
2//!
3//! A small, dependency-light parser for network capture files and the
4//! frames inside them. It handles two capture container formats —
5//! legacy PCAP and PCAPng — and dissects the resulting Ethernet frames
6//! down through VLAN tags, IPv4, and UDP/TCP, handing back the raw
7//! transport payload for a protocol-specific parser (DNS, DHCP, OSPF,
8//! whatever you're decoding) to take from there.
9//!
10//! It does not link against `libpcap`/`npcap` and has no `unsafe` code;
11//! it's pure Rust plus [`nom`] for the IPv4/PCAP binary parsing.
12//!
13//! ## Scope
14//!
15//! - **Containers:** legacy PCAP ([`pcap`]) and PCAPng ([`pcapng`]).
16//! - **Frames:** Ethernet II, optional single 802.1Q VLAN tag, optional
17//! double-tagged 802.1ad "Q-in-Q" framing, IPv4, UDP, TCP
18//! ([`ethernet`]).
19//! - **Out of scope:** IPv6, live capture, writing capture files. If you
20//! need those, this crate is not (yet) for you.
21//!
22//! ## Example
23//!
24//! ```
25//! use pcap_frame_parser::{pcap, ethernet};
26//!
27//! # let capture_bytes: &[u8] = &[
28//! # 0xd4, 0xc3, 0xb2, 0xa1, 2, 0, 4, 0, 0,0,0,0, 0,0,0,0, 0xff,0xff,0,0, 1,0,0,0,
29//! # ];
30//! let (header, packets) = pcap::iter_packets(capture_bytes)?;
31//! for packet in &packets {
32//! if let Some((ip_header, ip_payload)) = ethernet::extract_ip(packet.data) {
33//! if ip_header.protocol == ethernet::PROTO_UDP {
34//! if let Some((src_port, dst_port, payload)) = ethernet::extract_udp(ip_payload) {
35//! // hand `payload` off to a DNS/DHCP/whatever parser
36//! let _ = (src_port, dst_port, payload);
37//! }
38//! }
39//! }
40//! }
41//! # let _ = header;
42//! # Ok::<(), String>(())
43//! ```
44
45pub mod ethernet;
46pub mod pcap;
47pub mod pcapng;