1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101

//! # PCAP and PCAPNG parsers
//!
//! This crate contains several parsers for PCAP and PCAPNG files.
//!
//! Compared to other similar projects, it is designed to offer a complete support of the many
//! possible formats (legacy pcap, pcapng, little or big-endian, etc.) and features (pcanpng files
//! with multiple sections, interfaces, and endianness) while using only safe code and without
//! copying data (zero-copy).
//!
//! The code is available on [Github](https://github.com/rusticata/pcap-parser)
//! and is part of the [Rusticata](https://github.com/rusticata) project.
//!
//! # Example: streaming parsers
//!
//! The following code shows how to parse a file in the pcap-ng format, using a
//! [PcapNGReader](struct.PcapNGReader.html) streaming parser.
//!
//! ```rust
//! # extern crate nom;
//! # extern crate pcap_parser;
//! use pcap_parser::*;
//! use pcap_parser::traits::PcapReaderIterator;
//! use nom::ErrorKind;
//! use std::fs::File;
//! use std::io::Read;
//!
//! # fn main() {
//! # let path = "assets/test001-le.pcapng";
//! let mut file = File::open(path).unwrap();
//! let mut num_blocks = 0;
//! let mut reader = PcapNGReader::new(65536, file).expect("PcapNGReader");
//! loop {
//!     match reader.next() {
//!         Ok((offset, _block)) => {
//!             println!("got new block");
//!             num_blocks += 1;
//!             reader.consume(offset);
//!         },
//!         Err(ErrorKind::Eof) => break,
//!         Err(e) => panic!("error while reading: {:?}", e),
//!     }
//! }
//! println!("num_blocks: {}", num_blocks);
//! # }
//! ```
//! See [PcapNGReader](struct.PcapNGReader.html) for a complete example, including handling of
//! linktype and accessing packet data.
//!
//! For legacy pcap files, use similar code with the
//! [LegacyPcapReader](struct.LegacyPcapReader.html) streaming parser.
//!
//! See [pcap-tools](https://github.com/rusticata/pcap-tools) and
//! [pcap-parse](https://github.com/rusticata/pcap-parse) for more examples.
//!
//! # Example: generic streaming parsing
//!
//! To create a pcap reader for input in either PCAP or PCAPNG format, use the
//! [create_reader](fn.create_reader.html) function.

extern crate byteorder;

#[macro_use]
extern crate nom;

#[macro_use]
extern crate cookie_factory;

#[macro_use]
extern crate rusticata_macros;

mod utils;
pub use utils::{Data, MutableData};

mod blocks;
mod linktype;
pub use blocks::*;
pub use linktype::*;

pub mod pcap;
pub mod pcapng;
pub use pcap::*;
pub use pcapng::*;

pub mod traits;

mod capture;
mod capture_pcap;
mod capture_pcapng;
pub use capture::*;
pub use capture_pcap::*;
pub use capture_pcapng::*;

#[cfg(feature = "data")]
pub mod data;

#[cfg(feature = "data")]
mod pcap_nflog;

#[cfg(test)]
#[macro_use]
extern crate hex_literal;