Expand description
§pcap-frame-parser
A small, dependency-light parser for network capture files and the frames inside them. It handles two capture container formats — legacy PCAP and PCAPng — and dissects the resulting Ethernet frames down through VLAN tags, IPv4, and UDP/TCP, handing back the raw transport payload for a protocol-specific parser (DNS, DHCP, OSPF, whatever you’re decoding) to take from there.
It does not link against libpcap/npcap and has no unsafe code;
it’s pure Rust plus nom for the IPv4/PCAP binary parsing.
§Scope
- Containers: legacy PCAP (
pcap) and PCAPng (pcapng). - Frames: Ethernet II, optional single 802.1Q VLAN tag, optional
double-tagged 802.1ad “Q-in-Q” framing, IPv4, UDP, TCP
(
ethernet). - Out of scope: IPv6, live capture, writing capture files. If you need those, this crate is not (yet) for you.
§Example
use pcap_frame_parser::{pcap, ethernet};
let (header, packets) = pcap::iter_packets(capture_bytes)?;
for packet in &packets {
if let Some((ip_header, ip_payload)) = ethernet::extract_ip(packet.data) {
if ip_header.protocol == ethernet::PROTO_UDP {
if let Some((src_port, dst_port, payload)) = ethernet::extract_udp(ip_payload) {
// hand `payload` off to a DNS/DHCP/whatever parser
let _ = (src_port, dst_port, payload);
}
}
}
}