libpcapng 的 API 封装器

库

libpcapng-rs 为 libpcapng 提供 Rust 接口。

特性

目前提供的主要功能包括

• 创建新的 PCAP 文件
• 追加到现有的 PCAP 文件
• 写入带或不带时间戳的网络数据包帧
• 写入自定义帧
• 从 pcap 读取帧

构建

将以下内容添加到您的 Cargo.toml

[dependencies]
libpcapng_rs = { version = "0.1", features = ["static"] }

此包将编译 libpcapng 并将其静态链接到您的可执行文件。要编译 libpcapng，您需要

• GNU 工具链
• GNU make
• wandio
• pybind11
• cmake

MacOS

brew install wandio cmake pybind11

Debian

sudo apt-get install build-essential cmake libwandio1 libwandio1-dev pybind11-dev python3-pybind11

示例

Cargo.toml

# ...
[dependencies]
libpcapng-rs = { version="0.1.3", features = ["static"] }

main.rs

use libpcapng_rs::{PcapNg, PcapNgOpenMode};
use std::fs;

fn main() {
    let mut pcap_writer = PcapNg::new("test.pcapng", PcapNgOpenMode::Write);
    pcap_writer.open().expect("issue opening file");
    pcap_writer.write_custom("this is a test".as_bytes().to_vec()).expect("issue writing custom frame");
    pcap_writer.close();
    let mut pcap_writer = PcapNg::new("test.pcapng", PcapNgOpenMode::Read);
    pcap_writer.open().expect("issue opening file");
    pcap_writer.read_packets(Some(callback_rs)).unwrap();
    pcap_writer.close();
    fs::remove_file("test.pcapng").unwrap();
}

fn callback_rs(block_counter: u32, block_type: u32, block_total_length: u32, bytes: Vec<u8>) {
    println!("hello world");
    println!("block_counter: {}, block_type: {}, block_total_length: {} bytes {:02X?}", block_counter, block_type, block_total_length, bytes);
}

输出

hello world
block_counter: 1, block_type: 168627466, block_total_length: 28 bytes [4D, 3C, 2B, 1A, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 1C, 00, 00, 00]
hello world
block_counter: 2, block_type: 1, block_total_length: 20 bytes [65, 00, 00, 00, 00, 00, 00, 00, 14, 00, 00, 00]
hello world
block_counter: 3, block_type: 2989, block_total_length: 32 bytes [69, 7A, 00, 00, 74, 68, 69, 73, 20, 69, 73, 20, 61, 20, 74, 65, 73, 74, 00, 00, 20, 00, 00, 00]