Struct LegacyPcapReader

pub struct LegacyPcapReader<R>
where
    R: Read,
{ /* private fields */ }

Parsing iterator over legacy pcap data (streaming version)

Pcap Reader

This reader is a streaming parser based on a circular buffer, which means memory usage is constant, and that it can be used to parse huge files or infinite streams. It creates an abstraction over any input providing the Read trait, and takes care of managing the circular buffer to provide an iterator-like interface.

The first call to next will return the file header. Some information of this header must be stored (for ex. the data link type) to be able to parse following block contents. Following calls to next will always return legacy data blocks.

The size of the circular buffer has to be big enough for at least one complete block. Using a larger value (at least 65k) is advised to avoid frequent reads and buffer shifts.

There are precautions to take when reading multiple blocks before consuming data. See PcapReaderIterator for details.

Example

use pcap_parser::*;
use pcap_parser::traits::PcapReaderIterator;
use std::fs::File;

let file = File::open(path).unwrap();
let mut num_blocks = 0;
let mut reader = LegacyPcapReader::new(65536, file).expect("LegacyPcapReader");
loop {
    match reader.next() {
        Ok((offset, block)) => {
            println!("got new block");
            num_blocks += 1;
            match block {
                PcapBlockOwned::LegacyHeader(_hdr) => {
                    // save hdr.network (linktype)
                },
                PcapBlockOwned::Legacy(_b) => {
                    // use linktype to parse b.data()
                },
                PcapBlockOwned::NG(_) => unreachable!(),
            }
            reader.consume(offset);
        },
        Err(PcapError::Eof) => break,
        Err(PcapError::Incomplete(_)) => {
            reader.refill().unwrap();
        },
        Err(e) => panic!("error while reading: {:?}", e),
    }
}
println!("num_blocks: {}", num_blocks);

Implementations

impl<R> LegacyPcapReader<R>

where R: Read,

pub fn new( capacity: usize, reader: R, ) -> Result<LegacyPcapReader<R>, PcapError<&'static [u8]>>

Creates a new LegacyPcapReader<R> with the provided buffer capacity.

pub fn from_buffer( buffer: Buffer, reader: R, ) -> Result<LegacyPcapReader<R>, PcapError<&'static [u8]>>

Creates a new LegacyPcapReader<R> using the provided Buffer.

Trait Implementations

impl<R> PcapReaderIterator for LegacyPcapReader<R>

where R: Read,

fn next(&mut self) -> Result<(usize, PcapBlockOwned<'_>), PcapError<&[u8]>>

Get the next pcap block, if possible. Returns the number of bytes read and the block.

fn consume(&mut self, offset: usize)

Consume data, and shift buffer if needed.

fn consume_noshift(&mut self, offset: usize)

Consume date, but do not change the buffer. Blocks already read are still valid.

fn consumed(&self) -> usize

Get the number of consumed bytes

fn refill(&mut self) -> Result<(), PcapError<&[u8]>>

Refill the internal buffer, shifting it if necessary.

fn position(&self) -> usize

Get the position in the internal buffer. Can be used to determine if refill is required.

fn grow(&mut self, new_size: usize) -> bool

Grow size of the internal buffer.

fn data(&self) -> &[u8]

Returns a slice with all the available data

fn reader_exhausted(&self) -> bool

Returns true if underlying reader is exhausted