Struct pcap_file::pcapng::PcapNgParser

pub struct PcapNgParser { /* fields omitted */ }

Parser for a PcapNg formated stream.

You can match on PcapError::IncompleteBuffer to known if the parser need more data

Examples

use std::fs::File;
use pcap_file::pcapng::PcapNgParser;
use pcap_file::PcapError;

let data = vec![0_8;100];
let mut src = &data[..];

let (rem, mut pcapng_parser) = PcapNgParser::new(src).unwrap();
src = rem;

loop {

    match pcapng_parser.next_block(src) {
        Ok((rem, block)) => {

            //Parse block content
            let parsed_block = block.parsed().unwrap();

            // Do something

            // Don't forget to update src
            src = rem;

            // No more data, if no more incoming either then this is the end of the file
            if rem.is_empty() {
                break;
            }
        },
        Err(PcapError::IncompleteBuffer(needed)) => {},// Load more data into src
        Err(_) => {}// Parsing error
    }
}

Methods

impl PcapNgParser

pub fn new(src: &[u8]) -> Result<(&[u8], Self), PcapError>

Creates a new PcapNgParser.

Parses the first block which must be a valid SectionHeaderBlock

pub fn next_block<'a>(
    &mut self,
    src: &'a [u8]
) -> Result<(&'a [u8], Block<'a>), PcapError>

Returns the remainder and the next block

pub fn section(&self) -> &SectionHeaderBlock<'static>

Returns the current SectionHeaderBlock

pub fn interfaces(&self) -> &[InterfaceDescriptionBlock<'static>]

Returns the current interfaces

pub fn packet_interface(
    &self,
    packet: &EnhancedPacketBlock
) -> Option<&InterfaceDescriptionBlock>

Returns the InterfaceDescriptionBlock corresponding to the given packet