Module pcap 

Legacy PCAP file format parser.

Spec: https://wiki.wireshark.org/Development/LibpcapFileFormat

Only Ethernet-linked captures (network == 1) are supported; this matches the vast majority of real-world captures produced by tcpdump/Wireshark on wired or bridged interfaces.

Structs

PcapHeader

Global file header of a legacy PCAP capture.

RawPacket

A single captured frame with its timestamp.

Functions

iter_packets

Parses a full legacy PCAP buffer and returns the header plus every packet it contains. Truncated trailing records are silently dropped rather than causing the whole capture to be rejected, matching the tolerant behavior of Wireshark.

parse_packet

Parses a single packet record (16-byte record header + captured bytes).

parse_pcap_header

Parses the 24-byte global PCAP header.