Module pcap_parser::pcap

PCAP file format

See https://wiki.wireshark.org/Development/LibpcapFileFormat for details.

There are 2 main ways of parsing a PCAP file. The first method is to use parse_pcap. This method requires to load the entire file to memory, and thus may not be good for large files.

The PcapCapture implements the Capture trait to provide generic methods. However, this trait also reads the entire file.

The second method is to first parse the PCAP header using parse_pcap_header, then loop over parse_pcap_frame to get the data. This can be used in a streaming parser.

Structs

LegacyPcapBlock

Container for network data in legacy Pcap files

PcapHeader

PCAP global header

Functions

parse_pcap_frame

Read a PCAP record header and data

parse_pcap_frame_be

Read a PCAP record header and data (big-endian)

parse_pcap_header

Read the PCAP global header