Expand description
pcarp is a pure-Rust library for reading pcap-ng files.
- Correct: Agrees with
tshark
across a broad test suite. - Fast: Zero-copy. Performance is comparable to
libpcap
. - Flexible input: Takes anything which implements
Read
. - Flexible output: Exposes a streaming-iterator-style API.
- Reliable: No panics, even on malformed input.
See the README for more details.
The entry point is Capture
.
Example
let file = File::open("integration_tests/10_sqldeveloper10_2016.pcapng.xz").unwrap();
let uncompressed = xz2::read::XzDecoder::new(file);
let mut pcap = Capture::new(uncompressed).unwrap();
while let Some(pkt) = pcap.next() {
let pkt = pkt.unwrap();
println!("{:?} {}", pkt.timestamp, pkt.data.len());
}
Modules
[Internal] Block definitions.
Structs
A packet capture which can be iterated over.
A network interface.
The ID a network interface.
A single captured packet.