Expand description
An interface to TShark, the famous network protocol analyzer. TShark is a part of Wireshark distribution. This crate provides an API to start TShark and analyze it’s output. It lets you capture packet data from a live network, or read packets from a previously saved capture file, printing a decoded form of those packets. TShark’s native capture file format is pcapng format, which is also the format used by Wireshark and various other tools.
Many information about TShark usage could also be found here.
TShark application must be installed for this crate to work properly.
This crates supports both offline processing (using pcap file) and live analysis (using an interface or a fifo).
Examples
// Creates a builder with needed tshark parameters
let builder = rtshark::RTSharkBuilder::builder()
.input_path("/tmp/my.pcap");
// Start a new TShark process
let mut rtshark = match builder.spawn() {
Err(err) => { eprintln!("Error running tshark: {err}"); return }
Ok(rtshark) => rtshark,
};
// read packets until the end of the PCAP file
while let Some(packet) = rtshark.read().unwrap_or_else(|e| {
eprintln!("Error parsing TShark output: {e}");
None
}) {
for layer in packet {
println!("Layer: {}", layer.name());
for metadata in layer {
println!("\t{}", metadata.display());
}
}
}Structs
- A layer is a protocol in the protocol stack of a packet (example: IP layer). It may contain multiple Metadata.
- RTShark structure represents a TShark process. It allows controlling the TShark process and reading from application’s output. It is created by RTSharkBuilder.
- RTSharkBuilder is used to prepare arguments needed to start a TShark instance. When the mandatory input_path is set, it creates a RTSharkBuilderReady object, which can be used to add more optional parameters before spawning a RTShark instance.
- RTSharkBuilderReady is an object used to run to create a RTShark instance. It is possible to use it to add more optional parameters before starting a TShark application.