Struct pcap_parser::LegacyPcapReader
source · [−]pub struct LegacyPcapReader<R> where
R: Read, { /* private fields */ }
Expand description
Parsing iterator over legacy pcap data (streaming version)
Pcap Reader
This reader is a streaming parser based on a circular buffer, which means memory
usage is constant, and that it can be used to parse huge files or infinite streams.
It creates an abstraction over any input providing the Read
trait, and takes care
of managing the circular buffer to provide an iterator-like interface.
The first call to next
will return the file header. Some information of this header must
be stored (for ex. the data link type) to be able to parse following block contents.
Following calls to next
will always return legacy data blocks.
The size of the circular buffer has to be big enough for at least one complete block. Using a larger value (at least 65k) is advised to avoid frequent reads and buffer shifts.
There are precautions to take when reading multiple blocks before consuming data. See PcapReaderIterator for details.
Example
use pcap_parser::*;
use pcap_parser::traits::PcapReaderIterator;
use std::fs::File;
let file = File::open(path).unwrap();
let mut num_blocks = 0;
let mut reader = LegacyPcapReader::new(65536, file).expect("LegacyPcapReader");
loop {
match reader.next() {
Ok((offset, block)) => {
println!("got new block");
num_blocks += 1;
match block {
PcapBlockOwned::LegacyHeader(_hdr) => {
// save hdr.network (linktype)
},
PcapBlockOwned::Legacy(_b) => {
// use linktype to parse b.data()
},
PcapBlockOwned::NG(_) => unreachable!(),
}
reader.consume(offset);
},
Err(PcapError::Eof) => break,
Err(PcapError::Incomplete) => {
reader.refill().unwrap();
},
Err(e) => panic!("error while reading: {:?}", e),
}
}
println!("num_blocks: {}", num_blocks);
Implementations
sourceimpl<R> LegacyPcapReader<R> where
R: Read,
impl<R> LegacyPcapReader<R> where
R: Read,
sourcepub fn new(
capacity: usize,
reader: R
) -> Result<LegacyPcapReader<R>, PcapError<&'static [u8]>>
pub fn new(
capacity: usize,
reader: R
) -> Result<LegacyPcapReader<R>, PcapError<&'static [u8]>>
Creates a new LegacyPcapReader<R>
with the provided buffer capacity.
sourcepub fn from_buffer(
buffer: Buffer,
reader: R
) -> Result<LegacyPcapReader<R>, PcapError<&'static [u8]>>
pub fn from_buffer(
buffer: Buffer,
reader: R
) -> Result<LegacyPcapReader<R>, PcapError<&'static [u8]>>
Creates a new LegacyPcapReader<R>
using the provided Buffer
.
Trait Implementations
sourceimpl<R> PcapReaderIterator for LegacyPcapReader<R> where
R: Read,
impl<R> PcapReaderIterator for LegacyPcapReader<R> where
R: Read,
sourcefn next(&mut self) -> Result<(usize, PcapBlockOwned<'_>), PcapError<&[u8]>>
fn next(&mut self) -> Result<(usize, PcapBlockOwned<'_>), PcapError<&[u8]>>
Get the next pcap block, if possible. Returns the number of bytes read and the block. Read more
sourcefn consume_noshift(&mut self, offset: usize)
fn consume_noshift(&mut self, offset: usize)
Consume date, but do not change the buffer. Blocks already read are still valid.
sourcefn refill(&mut self) -> Result<(), PcapError<&[u8]>>
fn refill(&mut self) -> Result<(), PcapError<&[u8]>>
Refill the internal buffer, shifting it if necessary. Read more
sourcefn position(&self) -> usize
fn position(&self) -> usize
Get the position in the internal buffer. Can be used to determine if refill
is required.
sourcefn data(&self) -> &[u8]ⓘNotable traits for &'_ [u8]impl<'_> Read for &'_ [u8]impl<'_> Write for &'_ mut [u8]
fn data(&self) -> &[u8]ⓘNotable traits for &'_ [u8]impl<'_> Read for &'_ [u8]impl<'_> Write for &'_ mut [u8]
Returns a slice with all the available data
sourcefn reader_exhausted(&self) -> bool
fn reader_exhausted(&self) -> bool
Returns true if underlying reader is exhausted Read more
Auto Trait Implementations
impl<R> RefUnwindSafe for LegacyPcapReader<R> where
R: RefUnwindSafe,
impl<R> Send for LegacyPcapReader<R> where
R: Send,
impl<R> Sync for LegacyPcapReader<R> where
R: Sync,
impl<R> Unpin for LegacyPcapReader<R> where
R: Unpin,
impl<R> UnwindSafe for LegacyPcapReader<R> where
R: UnwindSafe,
Blanket Implementations
sourceimpl<T> BorrowMut<T> for T where
T: ?Sized,
impl<T> BorrowMut<T> for T where
T: ?Sized,
const: unstable · sourcefn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Mutably borrows from an owned value. Read more