stackforge_core/pcap/
mod.rs

1//! PCAP file I/O for reading and writing packet captures.
2//!
3//! Provides `rdpcap` for reading all packets from a file,
4//! `PcapIterator` for streaming large captures, and `wrpcap` for writing.
5
6pub mod reader;
7pub mod writer;
8
9use std::time::Duration;
10
11use crate::Packet;
12
13/// Metadata from a PCAP packet record.
14#[derive(Debug, Clone, Default)]
15pub struct PcapMetadata {
16    /// Timestamp of when the packet was captured.
17    pub timestamp: Duration,
18    /// Original length of the packet on the wire (may be larger than captured data).
19    pub orig_len: u32,
20}
21
22/// A captured packet with associated PCAP metadata.
23#[derive(Debug, Clone)]
24pub struct CapturedPacket {
25    /// The parsed/parseable packet.
26    pub packet: Packet,
27    /// PCAP capture metadata (timestamp, original length).
28    pub metadata: PcapMetadata,
29}
30
31/// PCAP link-layer type.
32#[derive(Debug, Clone, Copy, PartialEq, Eq)]
33pub struct LinkType(pub u32);
34
35impl LinkType {
36    pub const ETHERNET: Self = Self(1);
37    pub const RAW: Self = Self(101);
38    pub const LINUX_SLL: Self = Self(113);
39}
40
41pub use reader::{PcapIterator, rdpcap};
42pub use writer::{wrpcap, wrpcap_packets};
stackforge_core/pcap/mod.rs

stackforge_core/pcap/
mod.rs
