stackforge_core/pcap/
mod.rs

1//! PCAP and PcapNG file I/O for reading and writing packet captures.
2//!
3//! Provides `rdpcap` for reading all packets from a file (auto-detects format),
4//! `PcapIterator` / `PcapNgIterator` / `CaptureIterator` for streaming,
5//! and `wrpcap` / `wrpcapng` for writing.
6
7pub mod reader;
8pub mod writer;
9
10use std::time::Duration;
11
12use crate::Packet;
13
14/// Capture file format.
15#[derive(Debug, Clone, Copy, PartialEq, Eq)]
16pub enum CaptureFormat {
17    /// Classic PCAP format (`.pcap`).
18    Pcap,
19    /// PcapNG format (`.pcapng`).
20    PcapNg,
21}
22
23/// Metadata from a PCAP/PcapNG packet record.
24#[derive(Debug, Clone)]
25pub struct PcapMetadata {
26    /// Timestamp of when the packet was captured.
27    pub timestamp: Duration,
28    /// Original length of the packet on the wire (may be larger than captured data).
29    pub orig_len: u32,
30    /// PcapNG interface ID (None for classic PCAP).
31    pub interface_id: Option<u32>,
32    /// PcapNG per-packet comment (None for classic PCAP).
33    pub comment: Option<String>,
34}
35
36impl Default for PcapMetadata {
37    fn default() -> Self {
38        Self {
39            timestamp: Duration::ZERO,
40            orig_len: 0,
41            interface_id: None,
42            comment: None,
43        }
44    }
45}
46
47/// A captured packet with associated PCAP metadata.
48#[derive(Debug, Clone)]
49pub struct CapturedPacket {
50    /// The parsed/parseable packet.
51    pub packet: Packet,
52    /// PCAP capture metadata (timestamp, original length).
53    pub metadata: PcapMetadata,
54}
55
56/// PCAP link-layer type.
57#[derive(Debug, Clone, Copy, PartialEq, Eq)]
58pub struct LinkType(pub u32);
59
60impl LinkType {
61    pub const ETHERNET: Self = Self(1);
62    pub const RAW: Self = Self(101);
63    pub const LINUX_SLL: Self = Self(113);
64}
65
66pub use reader::{CaptureIterator, PcapIterator, PcapNgIterator, rdpcap};
67pub use writer::{PcapNgStreamWriter, wrpcap, wrpcap_packets, wrpcapng, wrpcapng_packets};
stackforge_core/pcap/mod.rs

stackforge_core/pcap/
mod.rs
