Struct pcaparse::cap::CapParser

pub struct CapParser { /* private fields */ }

Parses a Cap from a slice of bytes.

You can match on PcapError::IncompleteBuffer to known if the parser need more data.

Example

use pcaparse::cap::CapParser;
use pcaparse::PcapError;

let cap = vec![0_u8; 0];
let mut src = &cap[..];

// Creates a new parser and parse the cap header
let (rem, cap_parser) = CapParser::new(&cap[..]).unwrap();
src = rem;

loop {
    match cap_parser.next_packet(src) {
        Ok((rem, packet)) => {
            // Do something

            // Don't forget to update src
            src = rem;

            // No more data, if no more incoming either then this is the end of the file
            if rem.is_empty() {
                break;
            }
        },
        Err(PcapError::IncompleteBuffer) => {}, // Load more data into src
        Err(_) => {},                           // Parsing error
    }
}

Implementations

impl CapParser

pub fn new(slice: &[u8]) -> PcapResult<(&[u8], CapParser)>

Creates a new CapParser.

Returns the remainder and the parser.

pub fn next_packet<'a>( &self, slice: &'a [u8] ) -> PcapResult<(&'a [u8], CapPacket<'a>)>

Returns the remainder and the next CapPacket.

pub fn next_raw_packet<'a>( &self, slice: &'a [u8] ) -> PcapResult<(&'a [u8], RawCapPacket<'a>)>

Returns the remainder and the next RawCapPacket.

pub fn header(&self) -> CapHeader

Returns the header of the cap file.

Trait Implementations

impl Debug for CapParser

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.