Filament::Capture::PcapHeader
Inherits Struct < Value < Object
Represents the global header at the start of every PCAP file. This tells us everything we need to know about how to interpret the rest of the file: byte order, version, snap length, and link type.
reader = Filament::Capture::PcapReader.new("capture.pcap")
puts reader.header.link_type # => 1 (Ethernet)
puts reader.header.snaplen # => 65535Constructors
Creates a default header suitable for writing new PCAP files. Defaults to Ethernet link type and a generous snap length.
Instance methods
The link-layer header type. Determines how to parse the first bytes of each packet. See LINKTYPE_* constants above.
The magic number. In a properly read file this will always be PCAP_MAGIC_NATIVE (we normalize it during reading).
Accuracy of timestamps. Also always zero in practice. The PCAP format spec was aspirational about precision tracking.
Maximum number of bytes captured per packet. Common values are 65535 (capture everything) or 96 (just headers). Packets longer than this get truncated.
Checks whether the file version is one we know how to read. Currently we only support version 2.4, which is the only version that has ever existed in the wild.
GMT to local timezone correction, in seconds. In practice this is always zero because nobody actually sets it.
Major and minor version of the PCAP format. Almost always 2.4. If you see anything else, something weird is going on.