Struct PcapHeader

pub struct PcapHeader {
    pub version_major: u16,
    pub version_minor: u16,
    pub ts_correction: i32,
    pub ts_accuracy: u32,
    pub snaplen: u32,
    pub datalink: DataLink,
    pub ts_resolution: TsResolution,
    pub endianness: Endianness,
}

Pcap Global Header

Fields

version_major: u16

Major version number

version_minor: u16

Minor version number

ts_correction: i32

GMT to local timezone correction, should always be 0

ts_accuracy: u32

Timestamp accuracy, should always be 0

snaplen: u32

Max length of captured packet, typically 65535

datalink: DataLink

DataLink type (first layer in the packet)

ts_resolution: TsResolution

Timestamp resolution of the pcap (microsecond or nanosecond)

endianness: Endianness

Endianness of the pcap (excluding the packet data)

Implementations

impl PcapHeader

pub fn from_slice(slice: &[u8]) -> PcapResult<(&[u8], PcapHeader)>

Creates a new PcapHeader from a slice of bytes.

Returns an error if the reader doesn’t contain a valid pcap or if there is a reading error.

PcapError::IncompleteBuffer indicates that there is not enough data in the buffer.

pub fn write_to<W: Write>(&self, writer: &mut W) -> PcapResult<usize>

Writes a PcapHeader to a writer.

Uses the endianness of the header.

Trait Implementations

impl Clone for PcapHeader

fn clone(&self) -> PcapHeader

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PcapHeader

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PcapHeader

Creates a new PcapHeader with these parameters:

PcapHeader {
    version_major: 2,
    version_minor: 4,
    ts_correction: 0,
    ts_accuracy: 0,
    snaplen: 65535,
    datalink: DataLink::ETHERNET,
    ts_resolution: TsResolution::MicroSecond,
    endianness: Endianness::Big
};

fn default() -> Self

Returns the “default value” for a type.

impl PartialEq for PcapHeader

fn eq(&self, other: &PcapHeader) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Copy for PcapHeader

impl Eq for PcapHeader

impl StructuralPartialEq for PcapHeader