class

Filament::Capture::PcapWriter

Inherits Reference < Object

Creates new PCAP capture files. Writes the global header on initialization, then individual packets as they come in.

writer = Filament::Capture::PcapWriter.new("output.pcap")
writer.write_packet(packet_bytes, Time.utc)
writer.close

Constructors

new(path : String, link_type : UInt32 = LINKTYPE_ETHERNET, snaplen : UInt32 = 65535_u32) : PcapWriter

Opens a new PCAP file for writing. Creates the file and writes the global header immediately.

Source

new(io : IO, header : PcapHeader, owns_io : Bool = false)

Creates a writer from an existing IO and header. Writes the global header to the IO immediately.

Source

Class methods

open(path : String, link_type : UInt32 = LINKTYPE_ETHERNET, snaplen : UInt32 = 65535_u32, &block : PcapWriter -> )

Opens a PCAP file for writing, yields writer to block, and guarantees closure

Source

Instance methods

Closes the writer and flushes all pending data.

Source

flush

Flushes the underlying IO buffer to disk. Call this periodically during long captures so you don't lose data on a crash.

Source

header

The global header we wrote to the file

Source

packets_written

How many packets we've written so far

Source

write_packet(data : Bytes, timestamp : Time, original_length : UInt32 | Nil = nil)

Writes a single packet to the file. The data is the raw packet bytes (starting with the link-layer header), and timestamp is when the packet was captured.

If the data is longer than the snap length, it gets truncated in the file but the original length is preserved in the header.

Source

write_raw_packet(packet : RawPacket)

Writes a RawPacket struct to the file. Convenience wrapper around the bytes-based write_packet method.

Source