pub struct LegacyPcapReader<R> where
    R: Read
{ /* private fields */ }
Expand description

Parsing iterator over legacy pcap data (streaming version)

Pcap Reader

This reader is a streaming parser based on a circular buffer, which means memory usage is constant, and that it can be used to parse huge files or infinite streams. It creates an abstraction over any input providing the Read trait, and takes care of managing the circular buffer to provide an iterator-like interface.

The first call to next will return the file header. Some information of this header must be stored (for ex. the data link type) to be able to parse following block contents. Following calls to next will always return legacy data blocks.

The size of the circular buffer has to be big enough for at least one complete block. Using a larger value (at least 65k) is advised to avoid frequent reads and buffer shifts.

There are precautions to take when reading multiple blocks before consuming data. See PcapReaderIterator for details.

Example

use pcap_parser::*;
use pcap_parser::traits::PcapReaderIterator;
use std::fs::File;

let file = File::open(path).unwrap();
let mut num_blocks = 0;
let mut reader = LegacyPcapReader::new(65536, file).expect("LegacyPcapReader");
loop {
    match reader.next() {
        Ok((offset, block)) => {
            println!("got new block");
            num_blocks += 1;
            match block {
                PcapBlockOwned::LegacyHeader(_hdr) => {
                    // save hdr.network (linktype)
                },
                PcapBlockOwned::Legacy(_b) => {
                    // use linktype to parse b.data()
                },
                PcapBlockOwned::NG(_) => unreachable!(),
            }
            reader.consume(offset);
        },
        Err(PcapError::Eof) => break,
        Err(PcapError::Incomplete) => {
            reader.refill().unwrap();
        },
        Err(e) => panic!("error while reading: {:?}", e),
    }
}
println!("num_blocks: {}", num_blocks);

Implementations

Creates a new LegacyPcapReader<R> with the provided buffer capacity.

Creates a new LegacyPcapReader<R> using the provided Buffer.

Trait Implementations

Get the next pcap block, if possible. Returns the number of bytes read and the block. Read more

Consume data, and shift buffer if needed. Read more

Consume date, but do not change the buffer. Blocks already read are still valid.

Get the number of consumed bytes

Refill the internal buffer, shifting it if necessary. Read more

Get the position in the internal buffer. Can be used to determine if refill is required.

Grow size of the internal buffer.

Returns a slice with all the available data

Returns true if underlying reader is exhausted Read more

Auto Trait Implementations

Blanket Implementations

Gets the TypeId of self. Read more

Immutably borrows from an owned value. Read more

Mutably borrows from an owned value. Read more

Returns the argument unchanged.

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

The type returned in the event of a conversion error.

Performs the conversion.

The type returned in the event of a conversion error.

Performs the conversion.