Struct PcapParser

pub struct PcapParser { /* private fields */ }

Parses a Pcap from a slice of bytes.

You can match on PcapError::IncompleteBuffer to known if the parser need more data.

Example

use pcap_file::pcap::PcapParser;
use pcap_file::PcapError;

let pcap = vec![0_u8; 0];
let mut src = &pcap[..];

// Creates a new parser and parse the pcap header
let (rem, pcap_parser) = PcapParser::new(&pcap[..]).unwrap();
src = rem;

loop {
    match pcap_parser.next_packet(src) {
        Ok((rem, packet)) => {
            // Do something

            // Don't forget to update src
            src = rem;

            // No more data, if no more incoming either then this is the end of the file
            if rem.is_empty() {
                break;
            }
        },
        Err(PcapError::IncompleteBuffer) => {}, // Load more data into src
        Err(_) => {},                           // Parsing error
    }
}

Implementations

impl PcapParser

pub fn new(slice: &[u8]) -> PcapResult<(&[u8], PcapParser)>

Creates a new PcapParser.

Returns the remainder and the parser.

pub fn next_packet<'a>( &self, slice: &'a [u8], ) -> PcapResult<(&'a [u8], PcapPacket<'a>)>

Returns the remainder and the next PcapPacket.

pub fn next_raw_packet<'a>( &self, slice: &'a [u8], ) -> PcapResult<(&'a [u8], RawPcapPacket<'a>)>

Returns the remainder and the next RawPcapPacket.

pub fn header(&self) -> PcapHeader

Returns the header of the pcap file.

Trait Implementations

impl Debug for PcapParser

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.