dnsjit.input.zmmpcap3

Read input from a pcap file using mmap()

Usage

local input = require("dnsjit.input.zmmpcap").new()
input:zstd()
input:open("file.pcap.zst")
input:receiver(filter_or_output)
input:run()

Overview

Read input from a PCAP file by mapping the whole file to memory using mmap() and parse the PCAP without libpcap. After opening a file and reading the PCAP header, the attributes are populated.

Attributes

is_swapped: Indicate if the byte order in the PCAP is in reverse order of the host.

is_nanosec: Indicate if the time stamps are in nanoseconds or not.

magic_number: Magic number.

version_major: Major version number.

version_minor: Minor version number.

thiszone: GMT to local correction.

sigfigs: Accuracy of timestamps.

snaplen: Max length of captured packets, in octets.

network: The link type found in the PCAP header, see https://www.tcpdump.org/linktypes.html .

linktype: The data link type, mapped from network.

Functions

Zmmpcap.new(): Create a new Zmmpcap input.

Zmmpcap:log(): Return the Log object to control logging of this instance or module.

Zmmpcap:receiver(o): Set the receiver to pass objects to.

Zmmpcap:produce(): Return the C functions and context for producing objects.

Zmmpcap:lz4(): Use liblz4 to decompress the input file/data.

Zmmpcap:zstd(): Use libzstd to decompress the input file/data.

Zmmpcap:gzip(): Use zlib/gzip to decompress the input file/data.

Zmmpcap:lzma(): Use liblzma/xz to decompress the input file/data.

Zmmpcap:have_support(): Return true if support for selected compression library is built in.

Zmmpcap:open(file): Open a PCAP file for processing and read the PCAP header. Returns 0 on success.

Zmmpcap:run(): Start processing packets and send each packet read to the receiver. Returns 0 if all packets was read successfully.

Zmmpcap:packets(): Return the number of packets seen.

AUTHORS and CONTRIBUTORS

Jerry Lundström (DNS-OARC), Tomáš Křížek (CZ.NIC), Petr Špaček (ISC)

Maintained by DNS-OARC

https://www.dns-oarc.net/