[−][src]Crate pcarp
pcarp is a pure-Rust library for reading pcap-ng files.
- Correct: Agrees with
tshark
across a broad test suite. - Fast: Zero-copy. Performance is comparable to
libpcap
. - Flexible input: Takes anything which implements
Read
. - Flexible output: Exposes a streaming-iterator-style API.
- Reliable: No panics, even on malformed input.
See the README for more details.
The entry point is Capture
.
Example
let file = File::open("integration_tests/10_sqldeveloper10_2016.pcapng.xz").unwrap(); let uncompressed = xz2::read::XzDecoder::new(file); let mut pcap = Capture::new(uncompressed).unwrap(); while let Some(pkt) = pcap.next() { let pkt = pkt.unwrap(); println!("{:?} {}", pkt.timestamp, pkt.data.len()); }
Modules
block | [Internal] Block definitions. |
Structs
Capture | A packet capture which can be iterated over. |
Interface | A network interface. |
Packet | A single captured packet. |
Enums
Error | |
LinkType | The type of physical link backing a network interface. |