parses all packets, pretty fast

This commit is contained in:
Alon Levy 2023-12-29 01:28:53 +02:00
parent 2e4e7c7c07
commit 68757371a0
2 changed files with 33 additions and 3 deletions

View File

@ -7,5 +7,5 @@ edition = "2021"
[dependencies]
anyhow = "1.0.77"
pcap-parser = "0.14.1"
pcap-parser = { version = "0.14.1", features = ["data"] }
pyo3 = "0.20.0"

View File

@ -8,11 +8,40 @@ fn main() -> anyhow::Result<()> {
let mut cap = PcapNGReader::new(65535, file)?;
let mut i = 0;
let mut size = 0;
let mut data = vec![];
loop {
match cap.next() {
Ok((offset, _packet)) => {
Ok((offset, packet)) => {
i += 1;
size += offset;
match packet {
PcapBlockOwned::Legacy(block) => {
println!("dunno");
}
PcapBlockOwned::LegacyHeader(block) => {
println!("dunnoheader");
}
PcapBlockOwned::NG(block) => {
if block.is_data_block() {
match block {
Block::EnhancedPacket(ref epb) => {
if epb.origlen == 6972 {
// remove udp header
data.push(epb.data[0x2a..].to_vec());
}
}
Block::SimplePacket(ref ep) => {
if ep.origlen == 6972 {
println!("found one regular");
}
}
_ => {
println!("unsupported packet");
}
}
}
}
}
cap.consume(offset)
}
Err(PcapError::Eof) => break,
@ -25,6 +54,7 @@ fn main() -> anyhow::Result<()> {
}
}
}
println!("found {} packets, {} size", i, size);
println!("found {} packets, saved {}, {} size", i, data.len(), size);
println!("{:+?}", data);
Ok(())
}