Module sort 

Two-pass chronological sorting for legacy PCAP files.

Algorithm

First pass — scan the input file sequentially, tracking byte offsets. For each packet emit one PacketIndex record (20 bytes). The index is held in memory (default) or streamed to a .idx sidecar file (--on-disk).

Second pass — sort the index by timestamp_ns, then seek-and-stream packets in chronological order into one or more output PCAP files. Time-slicing (--slice) splits output into separate files at regular intervals.

Modules

index

Packet index types for two-pass chronological sorting.

Structs

SortOptions

Options for sort_file.

SortReport

Summary returned by sort_file on success.

Functions

parse_slice

Parse a human-readable slice duration string into seconds.

sort_file

Sort input chronologically and write the result according to opts.

sort_files

Sort and merge one or more input files chronologically.