pcap.h File Reference

The pcap file format, as much of it as a capture of Ethernet frames needs. More...

#include <cstdint>
#include <cstdio>
#include <expected>
#include <filesystem>
#include <span>
#include <string>
#include <vector>

Include dependency graph for pcap.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes
struct	mm::capture::Record
	One captured frame. More...
class	mm::capture::PcapWriter
	Writes records to a pcap file as they arrive. More...

Namespaces
namespace	mm
namespace	mm::capture

Functions
std::expected< std::vector< Record >, std::string >	mm::capture::parsePcap (std::span< const uint8_t > bytes)
	Reads every record of a pcap file held in memory.
std::expected< std::vector< Record >, std::string >	mm::capture::readPcap (const std::filesystem::path &path)
	Reads every record of a pcap file into memory. See parsePcap for what is accepted.

Detailed Description

The pcap file format, as much of it as a capture of Ethernet frames needs.

Written by hand rather than through libpcap, so the Linux build needs no library for it. The format is a 24-byte file header and a 16-byte header per record. Wireshark and tcpdump read it.