pcarp/block/
nrb.rs

1use crate::block::util::*;
2use bytes::{Buf, Bytes};
3
4/// Defines the mapping from numeric addresses present in the packet capture and the canonical name
5/// counterpart.
6///
7/// The Name Resolution Block (NRB) is used to support the correlation of numeric addresses
8/// (present in the captured packets) and their corresponding canonical names and it is optional.
9/// Having the literal names saved in the file prevents the need for performing name resolution at
10/// a later time, when the association between names and addresses may be different from the one in
11/// use at capture time. Moreover, the NRB avoids the need for issuing a lot of DNS requests every
12/// time the trace capture is opened, and also provides name resolution when reading the capture
13/// with a machine not connected to the network.
14///
15/// A Name Resolution Block is often placed at the beginning of the file, but no assumptions can be
16/// taken about its position. Multiple NRBs can exist in a pcapng file, either due to memory
17/// constraints or because additional name resolutions were performed by file processing tools,
18/// like network analyzers.
19///
20/// A Name Resolution Block need not contain any Records, except the nrb_record_end Record which
21/// MUST be the last Record. The addresses and names in NRB Records MAY be repeated multiple times;
22/// i.e., the same IP address may resolve to multiple names, the same name may resolve to the
23/// multiple IP addresses, and even the same address-to-name pair may appear multiple times, in the
24/// same NRB or across NRBs.
25///
26/// This documentation is copyright (c) 2018 IETF Trust and the persons identified as the
27/// authors of [this document][1]. All rights reserved. Please see the linked document for the full
28/// copyright notice.
29///
30/// [1]: https://github.com/pcapng/pcapng
31#[derive(Clone, PartialEq, Eq, Debug)]
32pub struct NameResolution {
33    /// Zero or more Name Resolution Records (in the TLV format), each of which contains an
34    /// association between a network address and a name. An nrb_record_end MUST be added after the
35    /// last Record, and MUST exist even if there are no other Records in the NRB.
36    pub record_values: Bytes, // TODO
37}
38
39impl FromBytes for NameResolution {
40    fn parse<T: Buf>(mut buf: T, _endianness: Endianness) -> Result<NameResolution, BlockError> {
41        Ok(NameResolution {
42            record_values: buf.copy_to_bytes(buf.remaining()),
43        })
44    }
45}
pcarp/block/nrb.rs

pcarp/block/
nrb.rs
