NAME

dnsjit.input.fpcap - Read input from a PCAP file using fopen()

SYNOPSIS

local input = require("dnsjit.input.fpcap").new()
input:open("file.pcap")
input:receiver(filter_or_output)
input:run()

DESCRIPTION

Read input from a PCAP file using standard library function fopen() and parse the PCAP without libpcap. After opening a file and reading the PCAP header, the attributes are populated.

Attributes

is_swapped: Indicate if the byte order in the PCAP is in reverse order of the host.
is_nanosec: Indicate if the time stamps are in nanoseconds or not.
magic_number: Magic number.
version_major: Major version number.
version_minor: Minor version number.
thiszone: GMT to local correction.
sigfigs: Accuracy of timestamps.
snaplen: Max length of captured packets, in octets.
network: The link type found in the PCAP header, see https://www.tcpdump.org/linktypes.html .
linktype: The data link type, mapped from network.

Functions

Fpcap.new(): Create a new Fpcap input.
Fpcap:log(): Return the Log object to control logging of this instance or module.
Fpcap:receiver(o): Set the receiver to pass objects to.
Fpcap:produce(): Return the C functions and context for producing objects.
Fpcap:fadvise_sequential(): Use posix_fadvise() to indicate sequential reading (if supported), may increase performance. MUST be called before open().
Fpcap:open(file): Open a PCAP file for processing and read the PCAP header. Returns 0 on success.
Fpcap:openfp(fp): Open a PCAP file for processing and read the PCAP header using a file descriptor, for example io.stdin or with io.open(). Will not take ownership of the file descriptor. Returns 0 on success.
Fpcap:run(): Start processing packets and send each packet read to the receiver. Returns 0 if all packets was read successfully.
Fpcap:packets(): Return the number of packets seen.

AUTHORS and CONTRIBUTORS

Jerry Lundström (DNS-OARC), Tomáš Křížek (CZ.NIC), Petr Špaček (ISC)

Maintained by DNS-OARC

https://www.dns-oarc.net/

BUGS

For issues and feature requests please use:

https://github.com/DNS-OARC/dnsjit/issues

For question and help please use:

admin@dns-oarc.net