#include <tsPcapFilter.h>

Inheritance diagram for ts::PcapFilter:

[legend]

Collaboration diagram for ts::PcapFilter:

[legend]

Public Member Functions
	PcapFilter (Report *report)
	PcapFilter (ReporterBase *delegate)
bool	addressFilterIsSet () const
virtual void	clearProtocolFilter ()
virtual void	close ()
void	defineArgs (Args &args)
const IPSocketAddress &	destinationFilter () const
bool	endOfFile () const
fs::path	fileName () const
uint64_t	fileSize () const
cn::microseconds	firstTimestamp () const
uint64_t	ipPacketCount () const
bool	isOpen () const
cn::microseconds	lastTimestamp () const
bool	loadArgs (Args &args)
bool	muteReport (bool mute)
virtual bool	open (const fs::path &filename) override
const IPSocketAddress &	otherFilter (const IPSocketAddress &addr) const
uint64_t	packetCount () const
virtual bool	readIP (IPPacket &packet, VLANIdStack &vlans, cn::microseconds &timestamp) override
virtual Report &	report () const override
virtual void	setBidirectionalFilter (const IPSocketAddress &addr1, const IPSocketAddress &addr2)
virtual void	setDestinationFilter (const IPSocketAddress &addr)
void	setFirstPacketFilter (size_t count)
void	setFirstTimeOffset (cn::microseconds time)
void	setFirstTimestamp (cn::microseconds time)
void	setLastPacketFilter (size_t count)
void	setLastTimeOffset (cn::microseconds time)
void	setLastTimestamp (cn::microseconds time)
virtual void	setProtocolFilter (const std::set< uint8_t > &protocols)
virtual void	setProtocolFilterTCP ()
virtual void	setProtocolFilterUDP ()
Report *	setReport (Report *report)
ReporterBase *	setReport (ReporterBase *delegate)
void	setReportAddressesFilterSeverity (int level)
virtual void	setSourceFilter (const IPSocketAddress &addr)
virtual void	setWildcardFilter (bool on)
const IPSocketAddress &	sourceFilter () const
cn::microseconds	timeOffset (cn::microseconds timestamp) const
uint64_t	totalIPPacketsSize () const
uint64_t	totalPacketsSize () const

Static Public Member Functions
static int	SilentLevel (bool silent, int default_severity=Severity::Error)
static Time	ToTime (cn::microseconds timestamp)

Static Public Attributes
static constexpr size_t	MAX_SANE_PCAP_PACKET_SIZE = 128 * 1024

Detailed Description

Read a pcap or pcapng file with packet filtering.

This class also sets filtering options from the command line: --first-packet, --first-timestamp, --first-date, --last-packet, --last-timestamp, --last-date.

Constructor & Destructor Documentation

◆ PcapFilter() [1/2]

ts::PcapFilter::PcapFilter ( Report * report )

inlineexplicit

Constructor.

Parameters

[in] report Where to report errors. The report object must remain valid as long as this object exists or setReport() is used with another Report object. If report is null, log messages are discarded.

◆ PcapFilter() [2/2]

ts::PcapFilter::PcapFilter ( ReporterBase * delegate )

inlineexplicit

Constructor.

Parameters

[in] delegate Use the report of another ReporterBase. If delegate is null, log messages are discarded.

Member Function Documentation

◆ setFirstPacketFilter()

void ts::PcapFilter::setFirstPacketFilter ( size_t count )

inline

Filter packets starting at the specified number. The packet numbering counts all captured packets from the beginning of the file, starting at 1. This is the same value as seen on Wireshark in the leftmost column.

Parameters

[in] count Number of first captured packet to read.

◆ setLastPacketFilter()

void ts::PcapFilter::setLastPacketFilter ( size_t count )

inline

Filter packets up to the specified number. The packet numbering counts all captured packets from the beginning of the file, starting at 1. This is the same value as seen on Wireshark in the leftmost column.

Parameters

[in] count Number of last captured packet to read.

◆ setFirstTimeOffset()

void ts::PcapFilter::setFirstTimeOffset ( cn::microseconds time )

inline

Filter packets starting at the specified time offset from the beginning of the file. This is the same value as seen on Wireshark in the "Time" column (in seconds).

Parameters

[in] time First time offset in microseconds from the beginning of the capture.

◆ setLastTimeOffset()

void ts::PcapFilter::setLastTimeOffset ( cn::microseconds time )

inline

Filter packets up to the specified time offset from the beginning of the file. This is the same value as seen on Wireshark in the "Time" column (in seconds).

Parameters

[in] time Last time offset in microseconds from the beginning of the capture.

◆ setFirstTimestamp()

void ts::PcapFilter::setFirstTimestamp ( cn::microseconds time )

inline

Filter packets starting at the specified timestamp.

Parameters

[in] time First timestamp, in microseconds from the UNIX epoch.

See also: ts::Time::UnixEpoch

◆ setLastTimestamp()

void ts::PcapFilter::setLastTimestamp ( cn::microseconds time )

inline

Filter packets up to the specified timestamp.

Parameters

[in] time Last timestamp, in microseconds from the UNIX epoch.

See also: ts::Time::UnixEpoch

◆ setProtocolFilterTCP()

virtual void ts::PcapFilter::setProtocolFilterTCP ( )

virtual

Filter TCP packets only.

◆ setProtocolFilterUDP()

virtual void ts::PcapFilter::setProtocolFilterUDP ( )

virtual

Filter UDP packets only.

◆ setProtocolFilter()

virtual void ts::PcapFilter::setProtocolFilter ( const std::set< uint8_t > & protocols )

virtual

Filter packets with the specified set of protocols.

Parameters

[in] protocols A set of 8-bit protocol values (eg. IPv4_PROTO_TCP, IPv4_PROTO_ICMP, etc.) If the filter is empty, all packets are passed (same as all protocol values set).

◆ clearProtocolFilter()

virtual void ts::PcapFilter::clearProtocolFilter ( )

virtual

Clear the set of protocols to filter, all protocols are accepted.

◆ setSourceFilter()

virtual void ts::PcapFilter::setSourceFilter ( const IPSocketAddress & addr )

virtual

Set a source address filter.

Parameters

[in] addr Source address to filter. The port is meaningful only with TCP and UDP.

See also: setWildcardFilter()

◆ setDestinationFilter()

virtual void ts::PcapFilter::setDestinationFilter ( const IPSocketAddress & addr )

virtual

Set a destination address filter.

Parameters

[in] addr Destination address to filter. The port is meaningful only with TCP and UDP.

See also: setWildcardFilter()

◆ setBidirectionalFilter()

virtual void ts::PcapFilter::setBidirectionalFilter	(	const IPSocketAddress &	addr1,
		const IPSocketAddress &	addr2 )

virtual

Set a bidirectional address filter. Select packets where the source and destination addresses match the pair of filtered address, in any direction.

Parameters

[in]	addr1	First address to filter, either source or destination. The port is meaningful only with TCP and UDP.
[in]	addr2	Second address to filter, either source or destination. The port is meaningful only with TCP and UDP.

See also: setWildcardFilter()

Reimplemented in ts::PcapStream.

◆ sourceFilter()

const IPSocketAddress & ts::PcapFilter::sourceFilter ( ) const

inline

Get the current source filter.

In the case of non-wildcard filtering, after returning the first packet, this is the actual socket address of the filtered stream.

In the case of bidirectional filtering (for instance a TCP session), there is no real "source" or "destination". They are the two endpoints of the stream.

Returns: A constant reference to the current source filter.

See also: setWildcardFilter()

◆ destinationFilter()

const IPSocketAddress & ts::PcapFilter::destinationFilter ( ) const

inline

Get the current destination filter.

In the case of non-wildcard filtering, after returning the first packet, this is the actual socket address of the filtered stream.

In the case of bidirectional filtering (for instance a TCP session), there is no real "source" or "destination". They are the two endpoints of the stream.

Returns: A constant reference to the current source filter.

See also: setWildcardFilter()

◆ setWildcardFilter()

virtual void ts::PcapFilter::setWildcardFilter ( bool on )

virtual

Set the source and destination address filter in wildcard mode.

When the address filter is in wildcard mode (the default), the unspecified parts of source and destination, address or port, act as wildcard for all packets.

When the wildcard mode is set to false, the first packet which matches the unspecified parts forces the addresses of that packet. In other words, the first packet which matches the wildcard forces a specific stream and all subsequent packets are filtered for that specific stream.

Parameters

[in] on If true, use wildcard mode for all packets. If false, the first packet which matches the wildcard forces a specific stream.

◆ addressFilterIsSet()

bool ts::PcapFilter::addressFilterIsSet ( ) const

Check if the address filter is precisely set. Using address filtering, some addresses or port may be unspecified, acting as a wildcard. In non-wildcard mode, the first packet matching this wildcard is selected and the corresponding stream is then exclusively filtered. At this point, the filter is precisely set.

Returns: True if the address filter is precisely set.

◆ otherFilter()

const IPSocketAddress & ts::PcapFilter::otherFilter ( const IPSocketAddress & addr ) const

Get the "other" filter (source or destination) based on the other one.

Parameters

[in] addr A socket address, typically matching the source or destination filter.

Returns: A constant reference to the other filter. If addr matches neither the source nor the destination filter, return an empty socket address.

◆ setReportAddressesFilterSeverity()

void ts::PcapFilter::setReportAddressesFilterSeverity ( int level )

inline

Specify the severity to report the filtered addresses once (in non-wildcard mode).

In non-wildcard mode, when the filtered addresses contain non-specified fields, the first packet which matches the filters define the stream. At this point, the selected stream is displayed (in debug mode by default). This function redefines the severity level (info or verbose for instance).

Parameters

[in] level Severity level to use.

◆ defineArgs()

void ts::PcapFilter::defineArgs ( Args & args )

Add command line option definitions in an Args.

Parameters

[in,out] args Command line arguments to update.

◆ loadArgs()

bool ts::PcapFilter::loadArgs ( Args & args )

Load arguments from command line. Args error indicator is set in case of incorrect arguments.

Parameters

[in,out] args Command line arguments.

Returns: True on success, false on error in argument line.

◆ open()

virtual bool ts::PcapFilter::open ( const fs::path & filename )

overridevirtual

Open the file for read.

Parameters

[in] filename File name. If empty or "-", use standard input.

Returns: True on success, false on error.

Reimplemented from ts::PcapFile.

Reimplemented in ts::PcapStream.

◆ readIP()

virtual bool ts::PcapFilter::readIP	(	IPPacket &	packet,
		VLANIdStack &	vlans,
		cn::microseconds &	timestamp )

overridevirtual

Read the next IP packet, IPv4 or IPv6, headers included. Skip intermediate metadata and other types of packets.

Parameters

[out]	packet	Received IP packet.
[out]	vlans	Stack of VLAN encapsulation from which the packet is extracted.
[out]	timestamp	Capture timestamp in microseconds since Unix epoch or -1 if none is available.

Returns: True on success, false on error.

Reimplemented from ts::PcapFile.

◆ isOpen()

bool ts::PcapFile::isOpen ( ) const

inlineinherited

Check if the file is open.

Returns: True if the file is open, false otherwise.

◆ fileName()

fs::path ts::PcapFile::fileName ( ) const

inlineinherited

Get the file name.

Returns: The file name as specified in open(). If the standard input is used, return "standard input".

◆ packetCount()

uint64_t ts::PcapFile::packetCount ( ) const

inlineinherited

Get the number of captured packets so far. This includes all packets, not only IP packets. This value is the number of the last returned packet, as seen in the left-most column in Wireshark interface.

Returns: The number of captured packets so far.

◆ endOfFile()

bool ts::PcapFile::endOfFile ( ) const

inlineinherited

Check if the end of file (or other error) has been reached.

Returns: True on end of file or error.

◆ ipPacketCount()

uint64_t ts::PcapFile::ipPacketCount ( ) const

inlineinherited

Get the number of valid captured IP packets so far.

Returns: The number of valid captured IP packets so far.

◆ fileSize()

uint64_t ts::PcapFile::fileSize ( ) const

inlineinherited

Get the total file size in bytes so far.

Returns: The total file size in bytes so far.

◆ totalPacketsSize()

uint64_t ts::PcapFile::totalPacketsSize ( ) const

inlineinherited

Get the total size in bytes of captured packets so far. This includes all packets, including link-layer headers when present.

Returns: The total size in bytes of captured packets so far.

◆ totalIPPacketsSize()

uint64_t ts::PcapFile::totalIPPacketsSize ( ) const

inlineinherited

Get the total size in bytes of valid captured IP packets so far. This includes all IP headers but not link-layer headers when present.

Returns: The total size in bytes of valid captured IP packets so far.

◆ firstTimestamp()

cn::microseconds ts::PcapFile::firstTimestamp ( ) const

inlineinherited

Get the capture timestamp of the first packet in the file.

Returns: Capture timestamp in microseconds since Unix epoch or -1 if none is available.

◆ lastTimestamp()

cn::microseconds ts::PcapFile::lastTimestamp ( ) const

inlineinherited

Get the capture timestamp of the last packet which was read from the file.

Returns: Capture timestamp in microseconds since Unix epoch or -1 if none is available.

◆ timeOffset()

cn::microseconds ts::PcapFile::timeOffset ( cn::microseconds timestamp ) const

inlineinherited

Compute the time offset from the beginning of the file of a packet timestamp.

Parameters

[in] timestamp Capture timestamp of a packet in the file.

Returns: Time offset in microseconds of the packet from the beginning of the file.

◆ ToTime()

Time ts::PcapFile::ToTime ( cn::microseconds timestamp )

inlinestaticinherited

Compute the date and time from a packet timestamp.

Parameters

[in] timestamp Capture timestamp of a packet in a file.

Returns: Corresponding date or Epoch in case of error.

◆ close()

virtual void ts::PcapFile::close ( )

virtualinherited

Close the file. Do not reset counters, file names, etc. The last values before close() are still accessible.

◆ report()

virtual Report & ts::ReporterBase::report ( ) const

overridevirtualinherited

Access the Report which is associated with this object. Can be called from another thread only if the Report object is thread-safe.

Returns: A reference to the associated report.

Implements ts::ReporterInterface.

◆ setReport() [1/2]

Report * ts::ReporterBase::setReport ( Report * report )

inherited

Associate this object with another Report to log errors.

Parameters

[in] report Where to report errors. The report object must remain valid as long as this object exists or setReport() is used with another Report object. If report is null, log messages are discarded.

Returns: The address of the previous Report object or a null pointer if there was none.

◆ setReport() [2/2]

ReporterBase * ts::ReporterBase::setReport ( ReporterBase * delegate )

inherited

Associate this object with another ReporterBase to log errors.

Parameters

[in] delegate Use the report of another ReporterBase. If delegate is null, the previous explicit Report is used..

Returns: The address of the previous ReporterBase object or a null pointer if there was none.

◆ muteReport()

bool ts::ReporterBase::muteReport ( bool mute )

inherited

Temporarily mute the associated report.

Parameters

[in] mute It true, report() will return a null report (log messages are discarded), until muteReport() is invoked again with mute set to false.

Returns: Previous state of the mute field.

◆ SilentLevel()

int ts::ReporterBase::SilentLevel	(	bool	silent,
		int	default_severity = Severity::Error )

inlinestaticinherited

Compute a log severity level from a "silent" parameter. Some subclass methods have a "silent" parameter to avoid reporting errors which may be insignificant, typically when closing a device after an error, in which case the close operation may produce other errors if the previous error left the device in an inconsistent state. While those errors should not be displayed as errors, we still display them at debug level.

Parameters

[in]	silent	If true, do not report errors, report debug messages instead.
[in]	default_severity	Default severity, in non-silent mode (error by default).

Returns: Error when silent is false, Debug otherwise.

Member Data Documentation

◆ MAX_SANE_PCAP_PACKET_SIZE

size_t ts::PcapFile::MAX_SANE_PCAP_PACKET_SIZE = 128 * 1024

staticconstexprinherited

Maximum credible size of a pcap packet, in bytes. Pcap packets have a 32-bit length field but a pcap packet cannot be 4 GB long. Use this constant to avoid silly memory allocations when the pcap file is corrupted.

The documentation for this class was generated from the following file:

tsPcapFilter.h

Public Member Functions

Static Public Member Functions

Static Public Attributes

Detailed Description

Constructor & Destructor Documentation

◆ PcapFilter() [1/2]

◆ PcapFilter() [2/2]

Member Function Documentation

◆ setFirstPacketFilter()

◆ setLastPacketFilter()

◆ setFirstTimeOffset()

◆ setLastTimeOffset()

◆ setFirstTimestamp()

◆ setLastTimestamp()

◆ setProtocolFilterTCP()

◆ setProtocolFilterUDP()

◆ setProtocolFilter()

◆ clearProtocolFilter()

◆ setSourceFilter()

◆ setDestinationFilter()

◆ setBidirectionalFilter()

◆ sourceFilter()

◆ destinationFilter()

◆ setWildcardFilter()

◆ addressFilterIsSet()

◆ otherFilter()

◆ setReportAddressesFilterSeverity()

◆ defineArgs()

◆ loadArgs()

◆ open()

◆ readIP()

◆ isOpen()

◆ fileName()

◆ packetCount()

◆ endOfFile()

◆ ipPacketCount()

◆ fileSize()

◆ totalPacketsSize()

◆ totalIPPacketsSize()

◆ firstTimestamp()

◆ lastTimestamp()

◆ timeOffset()

◆ ToTime()

◆ close()

◆ report()

◆ setReport() [1/2]

◆ setReport() [2/2]

◆ muteReport()

◆ SilentLevel()

Member Data Documentation

◆ MAX_SANE_PCAP_PACKET_SIZE