Module pcap_parser::pcapng

PCAPNG file format

See https://github.com/pcapng/pcapng for details.

There are 2 main ways of parsing a PCAPNG file. The first method is to use parse_pcapng. This method requires to load the entire file to memory, and thus may not be good for large files.

The PcapNGCapture implements the Capture trait to provide generic methods. However, this trait also reads the entire file.

The second method is to loop over parse_block and match the result. The first block should be a Section header, then there should be one or more interfaces, etc. This can be used in a streaming parser.

Structs

EnhancedPacketBlock
Interface
InterfaceDescriptionBlock
InterfacePacketIterator
InterfaceStatisticsBlock
OptionCode
PcapNGCapture	Generic interface for PCAPNG file access
PcapNGCaptureIterator
PcapNGHeader
PcapNGOption
Section
SectionHeaderBlock
SectionInterfaceIterator
SectionPacketIterator
SimplePacketBlock
UnknownBlock

Enums

Block

Constants

BOM_MAGIC	Byte Order magic
EPB_MAGIC	Enhanced Packet Block magic
IDB_MAGIC	Interface Description Block magic
IFS_MAGIC	Interface Statistic Block magic
NMR_MAGIC	Name Resolution Block magic
SHB_MAGIC	Section Header Block magic
SPB_MAGIC	Simple Packet Block magic

Functions

parse_block
parse_content_block
parse_enhancedpacketblock
parse_interface
parse_interfacedescription
parse_interfacedescriptionblock
parse_interfacestatisticsblock
parse_option
parse_pcapng	Parse the entire file
parse_section
parse_sectionheader
parse_sectionheaderblock
parse_simplepacketblock
parse_unknownblock