struct

Filament::Capture::PacketHeader

Inherits Struct < Value < Object

Each packet in a PCAP file is preceded by this header. It gives us the timestamp and the lengths (both captured and original).

The distinction between incl_len and orig_len is important: if the snap length was smaller than the packet, incl_len < orig_len and we only have a prefix of the packet data.

Constructors

new(ts_sec : UInt32, ts_usec : UInt32, incl_len : UInt32, orig_len : UInt32)

Source

Instance methods

incl_len

Number of bytes of packet data actually captured and saved in the file. May be less than orig_len if snapping occurred.

Source

orig_len

Original length of the packet as it appeared on the wire. This is the "real" packet size before any truncation.

Source

to_time(nano : Bool = false) : Time

Constructs a Crystal Time object from the packet timestamp. For nanosecond-resolution files, you should pass nano: true so we interpret ts_usec correctly.

Source

truncated?

Was this packet truncated by the snap length?

Source

ts_sec

Timestamp seconds since Unix epoch (1970-01-01 00:00:00 UTC)

Source

ts_usec

Timestamp sub-second component. Microseconds for standard PCAP, nanoseconds for nanosecond-resolution PCAP files.

Source