Expand description
Phase 5: Structured data export (JSON, Parquet, Avro).
Reads a PCAP file, applies optional filters, and writes each packet as a typed record to the requested format.
§Pipeline (7.3 channel-based)
- A producer thread streams packets from the PCAP file, applies
structured + BPF filters, and sends
PacketRecords through a boundedstd::sync::mpsc::sync_channel. - The main thread receives records and writes them to a
format-specific
PacketSink(JSON, Parquet, or Avro).
Decoupling I/O (producer) from serialisation (consumer) lets both stages run concurrently, improving throughput for CPU-bound formats.
Modules§
- avro
- Apache Avro writer for packet export.
- json
- JSONL (newline-delimited JSON) writer for packet export.
- parquet
- Apache Parquet columnar writer for packet export.
Structs§
- Export
Options - Options for
export_file(single-output convenience wrapper). - Export
Report - Summary returned by
export_fileon success. - Multi
Export Options - Options for
export_multi(fan-out to multiple simultaneous outputs). - Multi
Export Report - Summary returned by
export_multion success. - Output
Target - A single output target for fan-out export.
- Packet
Record - A single packet record ready for serialisation.
Enums§
- Export
Format - Output format for packet export.
Traits§
- Packet
Sink - Common interface for streaming packet writers.
Functions§
- export_
file - Export all packets from
inputto a single output (convenience wrapper aroundexport_multifor backward compatibility). - export_
multi - Export packets from
inputto one or more simultaneous outputs in a single streaming pass.