13 releases (3 stable)

3.0.0-rc1 Jan 9, 2024
2.0.0 Feb 1, 2023
2.0.0-rc1 Jan 13, 2023
1.1.1 Nov 19, 2019
0.7.0 Jun 25, 2017

#57 in Parser implementations

Download history 7433/week @ 2024-09-17 8591/week @ 2024-09-24 7732/week @ 2024-10-01 9369/week @ 2024-10-08 10128/week @ 2024-10-15 10899/week @ 2024-10-22 10279/week @ 2024-10-29 10121/week @ 2024-11-05 11670/week @ 2024-11-12 9878/week @ 2024-11-19 8637/week @ 2024-11-26 10440/week @ 2024-12-03 10064/week @ 2024-12-10 10081/week @ 2024-12-17 2869/week @ 2024-12-24 4354/week @ 2024-12-31

29,226 downloads per month
Used in 23 crates (20 directly)

MIT license

150KB
3K SLoC

pcap-file

Provides parsers, readers and writers for Pcap and PcapNg files.

For Pcap files see the pcap module.

For PcapNg files see the pcapng module.

Crates.io rustdoc Crates.io

Documentation

https://docs.rs/pcap-file

Installation

This crate is on crates.io. Add it to your Cargo.toml:

[dependencies]
pcap-file = "3.0.0-rc1"

Examples

PcapReader

use std::fs::File;
use pcap_file::pcap::PcapReader;

let file_in = File::open("test.pcap").expect("Error opening file");
let mut pcap_reader = PcapReader::new(file_in).unwrap();

// Read test.pcap
while let Some(pkt) = pcap_reader.next_packet() {
    //Check if there is no error
    let pkt = pkt.unwrap();

    //Do something
 }

PcapNgReader

use std::fs::File;
use pcap_file::pcapng::PcapNgReader;

let file_in = File::open("test.pcapng").expect("Error opening file");
let mut pcapng_reader = PcapNgReader::new(file_in).unwrap();

// Read test.pcapng
while let Some(block) = pcapng_reader.next_block() {
    // Check if there is no error
    let block = block.unwrap();

    //  Do something
}

Fuzzing

Currently there are 4 crude harnesses to check that the parser won't panic in any situation. To start fuzzing you must install cargo-fuzz with the command:

$ cargo install cargo-fuzz

And then, in the root of the repository, you can run the harnesses as:

$ cargo fuzz run pcap_reader
$ cargo fuzz run pcap_ng_reader
$ cargo fuzz run pcap_parser
$ cargo fuzz run pcap_ng_parser

Keep in mind that libfuzzer by default uses only one core, so you can either run all the harnesses in different terminals, or you can pass the -jobs and -workers attributes. More info can be found in its documentation here. To get better crash reports add to you rust flags: -Zsanitizer=address. E.g.

RUSTFLAGS="-Zsanitizer=address" cargo fuzz run pcap_reader

License

Licensed under MIT.

Disclaimer

To test the library I used the excellent PcapNg testing suite provided by hadrielk.

Dependencies

~0.4–0.9MB
~19K SLoC