dnsjit.input.mmpcap3
Read input from a pcap file using mmap()
Usage
local input = require("dnsjit.input.fpcap").new()
input:open("file.pcap")
input:receiver(filter_or_output)
input:run()
Overview
Read input from a PCAP file by mapping the whole file to memory using mmap() and parse the PCAP without libpcap. After opening a file and reading the PCAP header, the attributes are populated.
Attributes
- is_swapped
-
Indicate if the byte order in the PCAP is in reverse order of the host.
- is_nanosec
-
Indicate if the time stamps are in nanoseconds or not.
- magic_number
-
Magic number.
- version_major
-
Major version number.
- version_minor
-
Minor version number.
- thiszone
-
GMT to local correction.
- sigfigs
-
Accuracy of timestamps.
- snaplen
-
Max length of captured packets, in octets.
- network
-
The link type found in the PCAP header, see https://www.tcpdump.org/linktypes.html .
- linktype
-
The data link type, mapped from network.
Functions
Mmpcap.new()-
Create a new Mmpcap input.
Mmpcap:log()-
Return the Log object to control logging of this instance or module.
Mmpcap:receiver(o)-
Set the receiver to pass objects to.
Mmpcap:produce()-
Return the C functions and context for producing objects.
Mmpcap:open(file)-
Open a PCAP file for processing and read the PCAP header. Returns 0 on success.
Mmpcap:run()-
Start processing packets and send each packet read to the receiver. Returns 0 if all packets was read successfully.
Mmpcap:packets()-
Return the number of packets seen.
AUTHORS and CONTRIBUTORS
Jerry Lundström (DNS-OARC), Tomáš Křížek (CZ.NIC), Petr Špaček (ISC)
Maintained by DNS-OARC
https://www.dns-oarc.net/
Releases
2 releases since Debian 12 (Bookworm); the text changed 1 time.