Filament::Capture::RawPacket
Inherits Struct < Value < Object
Represents a single captured network packet with all the information we need to dissect and analyze it. This is a value type (struct) for performance, since we'll create millions of these during a typical analysis run.
packet = RawPacket.new(
data: raw_bytes,
timestamp: Time.utc,
original_length: 1514_u32,
capture_length: 1514_u32,
interface_id: 0_u32,
link_type: LinkType::Ethernet
)
puts packet.truncated? # => falseConstructors
Convenience constructor allowing captured_length keyword
Instance methods
How many bytes of the original packet are missing due to snap length truncation? Returns 0 if the full packet was captured.
How many bytes were actually captured. Equal to data.size, but stored explicitly for clarity and to match the PCAP format.
The raw packet bytes, starting with the link-layer header. This slice may be shorter than the original packet if snapping occurred.
Which interface captured this packet. For classic PCAP this is always 0 (there's only one interface). For pcapng, each interface gets a sequential ID.
The link-layer header type. Determines how to parse the first bytes of the packet data.
Returns the packet data starting after the link-layer header. This gives you the network layer (usually IP) payload directly. Returns nil if the packet is too short to contain even a complete link-layer header.
The original length of the packet on the wire, before any truncation due to snap length.
When the packet was captured. For file-based captures this comes from the packet header timestamp. For live captures it's set by the capture engine.
Returns the timestamp as nanoseconds since the Unix epoch. Maximum precision available from the capture.
Returns the timestamp as microseconds since the Unix epoch. Useful for high-precision timing calculations.
Was this packet truncated? Returns true if the captured data is shorter than what was actually on the wire.