Struct pcap_parser::LegacyPcapReader

pub struct LegacyPcapReader<R> where
    R: Read,  { /* fields omitted */ }

Parsing iterator over legacy pcap data (streaming version)

This iterator a streaming parser based on a circular buffer, so any input providing the Read trait can be used.

The first call to next will return the file header. Some information of this header must be stored (for ex. the data link type) to be able to parse following block contents. Following calls to next will always return legacy data blocks.

The size of the circular buffer has to be big enough for at least one complete block. Using a larger value (at least 65k) is advised to avoid frequent reads and buffer shifts.

There are precautions to take when reading multiple blocks before consuming data. See PcapReaderIterator for details.

use pcap_parser::*;
use pcap_parser::traits::PcapReaderIterator;
use std::fs::File;
use std::io::Read;

let mut file = File::open(path).unwrap();
let mut num_blocks = 0;
let mut reader = LegacyPcapReader::new(65536, file).expect("LegacyPcapReader");
loop {
    match reader.next() {
        Ok((offset, block)) => {
            println!("got new block");
            num_blocks += 1;
            match block {
                PcapBlockOwned::LegacyHeader(_hdr) => {
                    // save hdr.network (linktype)
                },
                PcapBlockOwned::Legacy(_b) => {
                    // use linktype to parse b.data()
                },
                PcapBlockOwned::NG(_) => unreachable!(),
            }
            reader.consume(offset);
        },
        Err(PcapError::Eof) => break,
        Err(PcapError::Incomplete) => {
            reader.refill().unwrap();
        },
        Err(e) => panic!("error while reading: {:?}", e),
    }
}
println!("num_blocks: {}", num_blocks);

Implementations

impl<R> LegacyPcapReader<R> where
    R: Read, 

pub fn new(
    capacity: usize,
    mut reader: R
) -> Result<LegacyPcapReader<R>, PcapError>

pub fn from_buffer(
    mut buffer: Buffer,
    mut reader: R
) -> Result<LegacyPcapReader<R>, PcapError>

Trait Implementations

impl<R> PcapReaderIterator<R> for LegacyPcapReader<R> where
    R: Read, 

pub fn next(&mut self) -> Result<(usize, PcapBlockOwned<'_>), PcapError>

Get the next pcap block, if possible. Returns the number of bytes read and the block.

pub fn consume(&mut self, offset: usize)

Consume data, and shift buffer if needed.

pub fn consume_noshift(&mut self, offset: usize)

Consume date, but do not change the buffer. Blocks already read are still valid.

pub fn refill(&mut self) -> Result<(), PcapError>

Refill the internal buffer, shifting it if necessary.

pub fn position(&self) -> usize

Get the position in the internal buffer. Can be used to determine if refill is required.

pub fn grow(&mut self, new_size: usize) -> bool

Grow size of the internal buffer.

pub fn data(&self) -> &[u8]

Returns a slice with all the available data