class

Filament::Capture::PcapReader

Inherits Enumerable < Reference < Object

Opens and reads PCAP capture files, yielding packets one at a time. Automatically handles endianness detection and byte swapping.

reader = Filament::Capture::PcapReader.new("traffic.pcap")
reader.each_packet do |data, timestamp, orig_len|
  puts "#{timestamp}: #{data.size} bytes (#{orig_len} on wire)"
end
reader.close

Constructors

new(path : String) : PcapReader

Opens a PCAP file by path. The file is opened for reading and will be closed when close is called.

Source

new(io : IO, owns_io : Bool = false)

Creates a reader from an existing IO object. If owns_io is true, calling close will also close the underlying IO.

Source

Class methods

open(path : String, &block : PcapReader -> )

Opens a PCAP file by path and yields reader to block

Source

Instance methods

Closes the reader and, if we own it, the underlying IO.

Source

each

Yields each packet as a RawPacket struct, satisfying Enumerable

Source

each_packet(ignore_truncated : Bool = false, &block : Bytes, Time, UInt32 -> )

Iterates over every packet in the file, yielding the raw packet bytes, the timestamp as a Time object, and the original wire length. This is the main workhorse method.

If the file is truncated mid-packet, raises TruncatedPacketError unless ignore_truncated is true, in which case it silently stops iterating.

Source

header

The parsed global header from the file

Source

nano

Whether this is a nanosecond-resolution PCAP file

Source

packets(ignore_truncated : Bool = false) : Array(RawPacket)

Returns an iterator of RawPacket structs instead of yielding. Useful when you want to collect packets into an array or chain with other iterators.

Source

packets_read

Number of packets read so far

Source

rewind

Resets the reader back to the first packet. Only works if the underlying IO supports seeking (i.e., it's a file, not a pipe).

Source

swapped

Whether we need to swap bytes (file endianness differs from ours)

Source