Read a pcap or pcapng capture file format. More...

#include <tsPcapFile.h>

Inheritance diagram for ts::PcapFile:

[legend]

Collaboration diagram for ts::PcapFile:

[legend]

Public Member Functions
	PcapFile (Report *report)
	Constructor.

	PcapFile (ReporterBase *delegate)
	Constructor.

virtual	~PcapFile () override
	Destructor.

virtual void	close ()
	Close the file.

bool	endOfFile () const
	Check if the end of file (or other error) has been reached.

fs::path	fileName () const
	Get the file name.

uint64_t	fileSize () const
	Get the total file size in bytes so far.

cn::microseconds	firstTimestamp () const
	Get the capture timestamp of the first packet in the file.

uint64_t	ipPacketCount () const
	Get the number of valid captured IP packets so far.

bool	isOpen () const
	Check if the file is open.

cn::microseconds	lastTimestamp () const
	Get the capture timestamp of the last packet which was read from the file.

bool	muteReport (bool mute)
	Temporarily mute the associated report.

virtual bool	open (const fs::path &filename)
	Open the file for read.

uint64_t	packetCount () const
	Get the number of captured packets so far.

virtual bool	readIP (IPPacket &packet, VLANIdStack &vlans, cn::microseconds &timestamp)
	Read the next IP packet, IPv4 or IPv6, headers included.

virtual Report &	report () const override
	Access the Report which is associated with this object.

Report *	setReport (Report *report)
	Associate this object with another Report to log errors.

ReporterBase *	setReport (ReporterBase *delegate)
	Associate this object with another ReporterBase to log errors.

cn::microseconds	timeOffset (cn::microseconds timestamp) const
	Compute the time offset from the beginning of the file of a packet timestamp.

uint64_t	totalIPPacketsSize () const
	Get the total size in bytes of valid captured IP packets so far.

uint64_t	totalPacketsSize () const
	Get the total size in bytes of captured packets so far.

Static Public Member Functions
static int	SilentLevel (bool silent, int default_severity=Severity::Error)
	Compute a log severity level from a "silent" parameter.

static Time	ToTime (cn::microseconds timestamp)
	Compute the date and time from a packet timestamp.

Detailed Description

Read a pcap or pcapng capture file format.

This is the type of files which is created by Wireshark. This class reads a pcap or pcapng file and extracts IP frames (IPv4 or IPv6). All metadata and all other types of frames are ignored.

See also: https://tools.ietf.org/pdf/draft-gharris-opsawg-pcap-02.pdf (PCAP); https://datatracker.ietf.org/doc/draft-gharris-opsawg-pcap/ (PCAP tracker); https://tools.ietf.org/pdf/draft-tuexen-opsawg-pcapng-04.pdf (PCAP-ng); https://datatracker.ietf.org/doc/draft-tuexen-opsawg-pcapng/ (PCAP-ng tracker)

Constructor & Destructor Documentation

◆ PcapFile() [1/2]

ts::PcapFile::PcapFile ( Report * report )

inlineexplicit

Constructor.

Parameters

[in] report Where to report errors. The report object must remain valid as long as this object exists or setReport() is used with another Report object. If report is null, log messages are discarded.

◆ PcapFile() [2/2]

ts::PcapFile::PcapFile ( ReporterBase * delegate )

inlineexplicit

Constructor.

Parameters

[in] delegate Use the report of another ReporterBase. If delegate is null, log messages are discarded.

Member Function Documentation

◆ open()

virtual bool ts::PcapFile::open ( const fs::path & filename )

virtual

Open the file for read.

Parameters

[in] filename File name. If empty or "-", use standard input.

Returns: True on success, false on error.

Reimplemented in ts::PcapFilter, and ts::PcapStream.

◆ isOpen()

bool ts::PcapFile::isOpen ( ) const

inline

Check if the file is open.

Returns: True if the file is open, false otherwise.

◆ fileName()

fs::path ts::PcapFile::fileName ( ) const

inline

Get the file name.

Returns: The file name as specified in open(). If the standard input is used, return "standard input".

◆ readIP()

virtual bool ts::PcapFile::readIP	(	IPPacket &	packet,
		VLANIdStack &	vlans,
		cn::microseconds &	timestamp
	)

virtual

Read the next IP packet, IPv4 or IPv6, headers included.

Skip intermediate metadata and other types of packets.

Parameters

[out]	packet	Received IP packet.
[out]	vlans	Stack of VLAN encapsulation from which the packet is extracted.
[out]	timestamp	Capture timestamp in microseconds since Unix epoch or -1 if none is available.

Returns: True on success, false on error.

Reimplemented in ts::PcapFilter.

◆ packetCount()

uint64_t ts::PcapFile::packetCount ( ) const

inline

Get the number of captured packets so far.

This includes all packets, not only IP packets. This value is the number of the last returned packet, as seen in the left-most column in Wireshark interface.

Returns: The number of captured packets so far.

◆ endOfFile()

bool ts::PcapFile::endOfFile ( ) const

inline

Check if the end of file (or other error) has been reached.

Returns: True on end of file or error.

◆ ipPacketCount()

uint64_t ts::PcapFile::ipPacketCount ( ) const

inline

Get the number of valid captured IP packets so far.

Returns: The number of valid captured IP packets so far.

◆ fileSize()

uint64_t ts::PcapFile::fileSize ( ) const

inline

Get the total file size in bytes so far.

Returns: The total file size in bytes so far.

◆ totalPacketsSize()

uint64_t ts::PcapFile::totalPacketsSize ( ) const

inline

Get the total size in bytes of captured packets so far.

This includes all packets, including link-layer headers when present.

Returns: The total size in bytes of captured packets so far.

◆ totalIPPacketsSize()

uint64_t ts::PcapFile::totalIPPacketsSize ( ) const

inline

Get the total size in bytes of valid captured IP packets so far.

This includes all IP headers but not link-layer headers when present.

Returns: The total size in bytes of valid captured IP packets so far.

◆ firstTimestamp()

cn::microseconds ts::PcapFile::firstTimestamp ( ) const

inline

Get the capture timestamp of the first packet in the file.

Returns: Capture timestamp in microseconds since Unix epoch or -1 if none is available.

◆ lastTimestamp()

cn::microseconds ts::PcapFile::lastTimestamp ( ) const

inline

Get the capture timestamp of the last packet which was read from the file.

Returns: Capture timestamp in microseconds since Unix epoch or -1 if none is available.

◆ timeOffset()

cn::microseconds ts::PcapFile::timeOffset ( cn::microseconds timestamp ) const

inline

Compute the time offset from the beginning of the file of a packet timestamp.

Parameters

[in] timestamp Capture timestamp of a packet in the file.

Returns: Time offset in microseconds of the packet from the beginning of the file.

◆ ToTime()

static Time ts::PcapFile::ToTime ( cn::microseconds timestamp )

inlinestatic

Compute the date and time from a packet timestamp.

Parameters

[in] timestamp Capture timestamp of a packet in a file.

Returns: Corresponding date or Epoch in case of error.

◆ close()

virtual void ts::PcapFile::close ( )

virtual

Close the file.

Do not reset counters, file names, etc. The last values before close() are still accessible.

◆ report()

virtual Report & ts::ReporterBase::report ( ) const

overridevirtualinherited

Access the Report which is associated with this object.

Can be called from another thread only if the Report object is thread-safe.

Returns: A reference to the associated report.

Implements ts::ReporterInterface.

◆ setReport() [1/2]

Report * ts::ReporterBase::setReport ( Report * report )

inherited

Associate this object with another Report to log errors.

Parameters

[in] report Where to report errors. The report object must remain valid as long as this object exists or setReport() is used with another Report object. If report is null, log messages are discarded.

Returns: The address of the previous Report object or a null pointer if there was none.

◆ setReport() [2/2]

ReporterBase * ts::ReporterBase::setReport ( ReporterBase * delegate )

inherited

Associate this object with another ReporterBase to log errors.

Parameters

[in] delegate Use the report of another ReporterBase. If delegate is null, the previous explicit Report is used..

Returns: The address of the previous ReporterBase object or a null pointer if there was none.

◆ muteReport()

bool ts::ReporterBase::muteReport ( bool mute )

inherited

Temporarily mute the associated report.

Parameters

[in] mute It true, report() will return a null report (log messages are discarded), until muteReport() is invoked again with mute set to false.

Returns: Previous state of the mute field.

◆ SilentLevel()

static int ts::ReporterBase::SilentLevel	(	bool	silent,
		int	default_severity = `Severity::Error`
	)

inlinestaticinherited

Compute a log severity level from a "silent" parameter.

Some subclass methods have a "silent" parameter to avoid reporting errors which may be insignificant, typically when closing a device after an error, in which case the close operation may produce other errors if the previous error left the device in an inconsistent state. While those errors should not be displayed as errors, we still display them at debug level.

Parameters

[in]	silent	If true, do not report errors, report debug messages instead.
[in]	default_severity	Default severity, in non-silent mode (error by default).

Returns: Error when silent is false, Debug otherwise.

The documentation for this class was generated from the following file:

tsPcapFile.h

Public Member Functions

Static Public Member Functions

Detailed Description

Constructor & Destructor Documentation

◆ PcapFile() [1/2]

◆ PcapFile() [2/2]

Member Function Documentation

◆ open()

◆ isOpen()

◆ fileName()

◆ readIP()

◆ packetCount()

◆ endOfFile()

◆ ipPacketCount()

◆ fileSize()

◆ totalPacketsSize()

◆ totalIPPacketsSize()

◆ firstTimestamp()

◆ lastTimestamp()

◆ timeOffset()

◆ ToTime()

◆ close()

◆ report()

◆ setReport() [1/2]

◆ setReport() [2/2]

◆ muteReport()

◆ SilentLevel()