Module pcapng 

PCAPng file format parser.

Spec: https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-05.txt

Only the block types produced by common capture tools are handled: Section Header Block, Interface Description Block, Enhanced/Obsolete Packet Block, and Simple Packet Block. Unknown block types are skipped using their declared length, so unrecognized-but-well-formed files still parse successfully.

Functions

parse_pcapng

Parses a PCAPng buffer and returns every Ethernet-linked packet found as (ts_sec, ts_usec, frame_bytes). Non-Ethernet interfaces are skipped. Packet data is copied out (owned Vec<u8>) because PCAPng blocks are not guaranteed to be contiguous with a single packet’s logical payload once padding/options are accounted for.