Crate pcarp

source ·
Expand description

pcarp is a pure-Rust library for reading pcapng files.

  • Correct: Agrees with tshark across a broad test suite.
  • Fast: Performance is similar to libpcap.
  • Flexible: Wraps anything which implements Read.
  • Ergonomic: It’s an iterator of Packets - no lifetimes.
  • Resilient: Handles malformed pcaps as gracefully as possible.

See the README for more details.

The entry point is Capture.


In this example, the pcap is compressed - but not to worry! Since Capture::new() takes anything with a Read impl, we can just wrap our File with an XzDecoder.

let path = "10_sqldeveloper10_2016.pcapng.xz";
let file = XzDecoder::new(File::open(path)?);
for pkt in Capture::new(file) {
    let pkt = pkt.unwrap();
    println!("{:?} {}", pkt.timestamp,;


  • [Internal] Block definitions.
  • Info and stats about the network interfaces used to capture packets


  • An iterator that reads packets from a pcap
  • A captured packet


  • An error; may be fatal or non-fatal