Struct PcapNgParser

pub struct PcapNgParser { /* private fields */ }

Parses a PcapNg from a slice of bytes.

You can match on PcapError::IncompleteBuffer to know if the parser need more data.

Example

use std::fs::File;

use pcap_file::pcapng::PcapNgParser;
use pcap_file::PcapError;

let pcap = std::fs::read("test.pcapng").expect("Error reading file");
let mut src = &pcap[..];

let (rem, mut pcapng_parser) = PcapNgParser::new(src).unwrap();
src = rem;

loop {
    match pcapng_parser.next_block(src) {
        Ok((rem, block)) => {
            // Do something

            // Don't forget to update src
            src = rem;
        },
        Err(PcapError::IncompleteBuffer) => {
            // Load more data into src
        },
        Err(_) => {
            // Handle parsing error
        },
    }
}

Implementations

impl PcapNgParser

pub fn new(src: &[u8]) -> Result<(&[u8], Self), PcapError>

Creates a new PcapNgParser.

Parses the first block which must be a valid SectionHeaderBlock.

pub fn next_block<'a>( &mut self, src: &'a [u8], ) -> Result<(&'a [u8], Block<'a>), PcapError>

Returns the remainder and the next Block.

pub fn next_raw_block<'a>( &mut self, src: &'a [u8], ) -> Result<(&'a [u8], RawBlock<'a>), PcapError>

Returns the remainder and the next RawBlock.

pub fn section(&self) -> &SectionHeaderBlock<'static>

Returns the current SectionHeaderBlock.

pub fn interfaces(&self) -> &[InterfaceDescriptionBlock<'static>]

Returns all the current InterfaceDescriptionBlock.

pub fn packet_interface( &self, packet: &EnhancedPacketBlock<'_>, ) -> Option<&InterfaceDescriptionBlock<'_>>

Returns the InterfaceDescriptionBlock corresponding to the given packet.