#include <tsPcapFile.h>
Read a pcap or pcapng capture file format.
This is the type of files which is created by Wireshark. This class reads a pcap or pcapng file and extracts IP frames (IPv4 or IPv6). All metadata and all other types of frames are ignored.
- See also
- https://tools.ietf.org/pdf/draft-gharris-opsawg-pcap-02.pdf (PCAP)
-
https://datatracker.ietf.org/doc/draft-gharris-opsawg-pcap/ (PCAP tracker)
-
https://tools.ietf.org/pdf/draft-tuexen-opsawg-pcapng-04.pdf (PCAP-ng)
-
https://datatracker.ietf.org/doc/draft-tuexen-opsawg-pcapng/ (PCAP-ng tracker)
◆ PcapFile() [1/2]
| ts::PcapFile::PcapFile |
( |
Report * | report | ) |
|
|
inlineexplicit |
Constructor.
- Parameters
-
| [in] | report | Where to report errors. The report object must remain valid as long as this object exists or setReport() is used with another Report object. If report is null, log messages are discarded. |
◆ PcapFile() [2/2]
Constructor.
- Parameters
-
| [in] | delegate | Use the report of another ReporterBase. If delegate is null, log messages are discarded. |
◆ ~PcapFile()
| virtual ts::PcapFile::~PcapFile |
( |
| ) |
|
|
overridevirtual |
◆ open()
| virtual bool ts::PcapFile::open |
( |
const fs::path & | filename | ) |
|
|
virtual |
Open the file for read.
- Parameters
-
| [in] | filename | File name. If empty or "-", use standard input. |
- Returns
- True on success, false on error.
Reimplemented in ts::PcapFilter, and ts::PcapStream.
◆ isOpen()
| bool ts::PcapFile::isOpen |
( |
| ) |
const |
|
inline |
Check if the file is open.
- Returns
- True if the file is open, false otherwise.
◆ fileName()
| fs::path ts::PcapFile::fileName |
( |
| ) |
const |
|
inline |
Get the file name.
- Returns
- The file name as specified in open(). If the standard input is used, return "standard input".
◆ readIP()
| virtual bool ts::PcapFile::readIP |
( |
IPPacket & | packet, |
|
|
VLANIdStack & | vlans, |
|
|
cn::microseconds & | timestamp ) |
|
virtual |
Read the next IP packet, IPv4 or IPv6, headers included. Skip intermediate metadata and other types of packets.
- Parameters
-
| [out] | packet | Received IP packet. |
| [out] | vlans | Stack of VLAN encapsulation from which the packet is extracted. |
| [out] | timestamp | Capture timestamp in microseconds since Unix epoch or -1 if none is available. |
- Returns
- True on success, false on error.
Reimplemented in ts::PcapFilter.
◆ packetCount()
| uint64_t ts::PcapFile::packetCount |
( |
| ) |
const |
|
inline |
Get the number of captured packets so far. This includes all packets, not only IP packets. This value is the number of the last returned packet, as seen in the left-most column in Wireshark interface.
- Returns
- The number of captured packets so far.
◆ endOfFile()
| bool ts::PcapFile::endOfFile |
( |
| ) |
const |
|
inline |
Check if the end of file (or other error) has been reached.
- Returns
- True on end of file or error.
◆ ipPacketCount()
| uint64_t ts::PcapFile::ipPacketCount |
( |
| ) |
const |
|
inline |
Get the number of valid captured IP packets so far.
- Returns
- The number of valid captured IP packets so far.
◆ fileSize()
| uint64_t ts::PcapFile::fileSize |
( |
| ) |
const |
|
inline |
Get the total file size in bytes so far.
- Returns
- The total file size in bytes so far.
◆ totalPacketsSize()
| uint64_t ts::PcapFile::totalPacketsSize |
( |
| ) |
const |
|
inline |
Get the total size in bytes of captured packets so far. This includes all packets, including link-layer headers when present.
- Returns
- The total size in bytes of captured packets so far.
◆ totalIPPacketsSize()
| uint64_t ts::PcapFile::totalIPPacketsSize |
( |
| ) |
const |
|
inline |
Get the total size in bytes of valid captured IP packets so far. This includes all IP headers but not link-layer headers when present.
- Returns
- The total size in bytes of valid captured IP packets so far.
◆ firstTimestamp()
| cn::microseconds ts::PcapFile::firstTimestamp |
( |
| ) |
const |
|
inline |
Get the capture timestamp of the first packet in the file.
- Returns
- Capture timestamp in microseconds since Unix epoch or -1 if none is available.
◆ lastTimestamp()
| cn::microseconds ts::PcapFile::lastTimestamp |
( |
| ) |
const |
|
inline |
Get the capture timestamp of the last packet which was read from the file.
- Returns
- Capture timestamp in microseconds since Unix epoch or -1 if none is available.
◆ timeOffset()
| cn::microseconds ts::PcapFile::timeOffset |
( |
cn::microseconds | timestamp | ) |
const |
|
inline |
Compute the time offset from the beginning of the file of a packet timestamp.
- Parameters
-
| [in] | timestamp | Capture timestamp of a packet in the file. |
- Returns
- Time offset in microseconds of the packet from the beginning of the file.
◆ ToTime()
| Time ts::PcapFile::ToTime |
( |
cn::microseconds | timestamp | ) |
|
|
inlinestatic |
Compute the date and time from a packet timestamp.
- Parameters
-
| [in] | timestamp | Capture timestamp of a packet in a file. |
- Returns
- Corresponding date or Epoch in case of error.
◆ close()
| virtual void ts::PcapFile::close |
( |
| ) |
|
|
virtual |
Close the file. Do not reset counters, file names, etc. The last values before close() are still accessible.
◆ report()
| virtual Report & ts::ReporterBase::report |
( |
| ) |
const |
|
overridevirtualinherited |
Access the Report which is associated with this object. Can be called from another thread only if the Report object is thread-safe.
- Returns
- A reference to the associated report.
Implements ts::ReporterInterface.
◆ setReport() [1/2]
Associate this object with another Report to log errors.
- Parameters
-
| [in] | report | Where to report errors. The report object must remain valid as long as this object exists or setReport() is used with another Report object. If report is null, log messages are discarded. |
- Returns
- The address of the previous Report object or a null pointer if there was none.
◆ setReport() [2/2]
Associate this object with another ReporterBase to log errors.
- Parameters
-
| [in] | delegate | Use the report of another ReporterBase. If delegate is null, the previous explicit Report is used.. |
- Returns
- The address of the previous ReporterBase object or a null pointer if there was none.
◆ muteReport()
| bool ts::ReporterBase::muteReport |
( |
bool | mute | ) |
|
|
inherited |
Temporarily mute the associated report.
- Parameters
-
| [in] | mute | It true, report() will return a null report (log messages are discarded), until muteReport() is invoked again with mute set to false. |
- Returns
- Previous state of the mute field.
◆ SilentLevel()
| int ts::ReporterBase::SilentLevel |
( |
bool | silent, |
|
|
int | default_severity = Severity::Error ) |
|
inlinestaticinherited |
Compute a log severity level from a "silent" parameter. Some subclass methods have a "silent" parameter to avoid reporting errors which may be insignificant, typically when closing a device after an error, in which case the close operation may produce other errors if the previous error left the device in an inconsistent state. While those errors should not be displayed as errors, we still display them at debug level.
- Parameters
-
| [in] | silent | If true, do not report errors, report debug messages instead. |
| [in] | default_severity | Default severity, in non-silent mode (error by default). |
- Returns
- Error when silent is false, Debug otherwise.
◆ MAX_SANE_PCAP_PACKET_SIZE
| size_t ts::PcapFile::MAX_SANE_PCAP_PACKET_SIZE = 128 * 1024 |
|
staticconstexpr |
Maximum credible size of a pcap packet, in bytes. Pcap packets have a 32-bit length field but a pcap packet cannot be 4 GB long. Use this constant to avoid silly memory allocations when the pcap file is corrupted.
The documentation for this class was generated from the following file:
1.15.0