Crate rustnet_capture 

rustnet-capture

Packet-capture backend for RustNet, built on libpcap / Npcap via the pcap crate. This crate owns all of RustNet’s pcap-based capture: device selection, BPF-filter setup, the macOS PKTAP fast path for process metadata, TUN/TAP handling, and a simple PacketReader that yields raw link-layer frames.

It is deliberately separate from the analysis core (rustnet-core) and the rustnet application so that alternative front-ends — e.g. a headless Prometheus exporter — can pair capture with rustnet-core without pulling in the TUI, and so that platforms wanting a bespoke capture path (e.g. a root-free macOS pktap helper) can swap this crate out entirely.

Capture yields raw bytes plus the libpcap data-link type (DLT); parsing those bytes is rustnet-core’s job.

Structs

CaptureConfig

Packet capture configuration

CaptureStats

Packet capture statistics

CapturedPacket

A captured link-layer frame with the timestamp reported by libpcap/Npcap.

PacketReader

Simple packet reader that handles timeouts gracefully

Functions

setup_packet_capture

Setup packet capture with the given configuration

validate_interface

Validate that the specified interface exists (if provided) This is useful for failing fast before starting capture threads