Protocol

pcapsql_core::protocol

Trait Protocol 

Source 
pub trait Protocol: Send + Sync {
    // Required methods
    fn name(&self) -> &'static str;
    fn can_parse(&self, context: &ParseContext) -> Option<u32>;
    fn parse<'a>(
        &self,
        data: &'a [u8],
        context: &ParseContext,
    ) -> ParseResult<'a>;
    fn schema_fields(&self) -> Vec<FieldDescriptor>;

    // Provided methods
    fn display_name(&self) -> &'static str { ... }
    fn child_protocols(&self) -> &[&'static str] { ... }
    fn payload_mode(&self) -> PayloadMode { ... }
    fn dependencies(&self) -> &'static [&'static str] { ... }
    fn parse_projected<'a>(
        &self,
        data: &'a [u8],
        context: &ParseContext,
        _fields: Option<&HashSet<String>>,
    ) -> ParseResult<'a> { ... }
    fn cheap_fields(&self) -> &'static [&'static str] { ... }
    fn expensive_fields(&self) -> &'static [&'static str] { ... }
}
Expand description

Core trait all protocol parsers must implement.

Required Methods§

Source

fn name(&self) -> &'static str

Unique identifier for this protocol (e.g., “tcp”, “dns”).

Source

fn can_parse(&self, context: &ParseContext) -> Option<u32>

Check if this parser can handle the given context. Returns a priority score (higher = more specific match). Returns None if this parser cannot handle the context.

Source

fn parse<'a>(&self, data: &'a [u8], context: &ParseContext) -> ParseResult<'a>

Parse bytes into structured fields.

Source

fn schema_fields(&self) -> Vec<FieldDescriptor>

Return the schema fields this protocol produces.

Provided Methods§

Source

fn display_name(&self) -> &'static str

Human-readable display name.

Source

fn child_protocols(&self) -> &[&'static str]

Protocols that might follow this one.

Source

fn payload_mode(&self) -> PayloadMode

How should remaining bytes be handled after parsing?

  • Chain: Continue parsing with child protocols (default)
  • Stream: Route to StreamManager for TCP reassembly
  • None: Stop parsing (terminal protocol)
Source

fn dependencies(&self) -> &'static [&'static str]

Protocols that must be parsed before this one can be reached.

Used for protocol pruning optimization - when a query only needs certain protocols, we can skip parsing protocols not in the transitive dependency chain.

Returns a list of protocol names that could appear in the parse chain before this protocol (e.g., TCP depends on ipv4, ipv6).

Source

fn parse_projected<'a>( &self, data: &'a [u8], context: &ParseContext, _fields: Option<&HashSet<String>>, ) -> ParseResult<'a>

Parse with field projection - only extract requested fields.

If fields is None, extract all fields (default behavior). If fields is Some, only extract fields in the set.

Note: frame_number and timestamp are always available from the packet metadata, not from parsing.

The default implementation ignores projection and calls parse(). Protocols can override this to skip expensive field extraction.

Source

fn cheap_fields(&self) -> &'static [&'static str]

Returns fields that are “cheap” to extract (header fields parsed anyway).

These fields come from the basic header parse that must happen regardless of projection. Used to decide if projection is worthwhile.

Source

fn expensive_fields(&self) -> &'static [&'static str]

Returns fields that are “expensive” to extract.

These fields require additional parsing beyond the basic header, such as variable-length options, compressed data, or string parsing.

Implementors§