pcap_processor/
cli.rs

1use clap::{Parser, Subcommand, ValueEnum};
2use std::path::PathBuf;
3
4#[derive(Parser)]
5#[command(name = "pcap-processor")]
6#[command(about = "Extract and summarize information from pcap files")]
7#[command(version)]
8pub struct Cli {
9    #[command(subcommand)]
10    pub command: Commands,
11
12    /// Custom tshark path
13    #[arg(long, global = true, env = "PCAP_PROCESSOR_TSHARK")]
14    pub tshark: Option<PathBuf>,
15}
16
17#[derive(Subcommand)]
18pub enum Commands {
19    /// Extract unique values for a packet field
20    Unique(UniqueArgs),
21
22    /// Extract matching packets to a new pcap file (not yet implemented)
23    Extract(ExtractArgs),
24}
25
26#[derive(Parser)]
27pub struct UniqueArgs {
28    /// Wireshark field name (e.g., ip.src, tcp.port, cflow.inputint)
29    pub field: String,
30
31    /// Input pcap file(s) - supports glob patterns
32    #[arg(required = true)]
33    pub files: Vec<String>,
34
35    /// Wireshark display filter
36    #[arg(short, long)]
37    pub filter: Option<String>,
38
39    /// Output format
40    #[arg(short = 'F', long, value_enum, default_value = "plain")]
41    pub format: OutputFormat,
42
43    /// Include occurrence counts
44    #[arg(short, long)]
45    pub count: bool,
46
47    /// Sort order for results
48    #[arg(short, long, value_enum, default_value = "value")]
49    pub sort: SortOrder,
50
51    /// Disable name resolution (faster)
52    #[arg(short, long)]
53    pub no_resolve: bool,
54}
55
56#[derive(Parser)]
57pub struct ExtractArgs {
58    /// Wireshark display filter for matching packets
59    #[arg(short, long)]
60    pub filter: String,
61
62    /// Input pcap file(s)
63    #[arg(required = true)]
64    pub files: Vec<String>,
65
66    /// Output pcap file
67    #[arg(short, long)]
68    pub output: PathBuf,
69}
70
71#[derive(ValueEnum, Clone, Copy, Default)]
72pub enum OutputFormat {
73    #[default]
74    Plain,
75    Json,
76    Csv,
77}
78
79#[derive(ValueEnum, Clone, Copy, Default)]
80pub enum SortOrder {
81    #[default]
82    Value,
83    Count,
84}
pcap_processor/cli.rs

pcap_processor/
cli.rs
