parses all packets, pretty fast
This commit is contained in:
parent
2e4e7c7c07
commit
68757371a0
|
@ -7,5 +7,5 @@ edition = "2021"
|
|||
|
||||
[dependencies]
|
||||
anyhow = "1.0.77"
|
||||
pcap-parser = "0.14.1"
|
||||
pcap-parser = { version = "0.14.1", features = ["data"] }
|
||||
pyo3 = "0.20.0"
|
||||
|
|
|
@ -8,11 +8,40 @@ fn main() -> anyhow::Result<()> {
|
|||
let mut cap = PcapNGReader::new(65535, file)?;
|
||||
let mut i = 0;
|
||||
let mut size = 0;
|
||||
let mut data = vec![];
|
||||
loop {
|
||||
match cap.next() {
|
||||
Ok((offset, _packet)) => {
|
||||
Ok((offset, packet)) => {
|
||||
i += 1;
|
||||
size += offset;
|
||||
match packet {
|
||||
PcapBlockOwned::Legacy(block) => {
|
||||
println!("dunno");
|
||||
}
|
||||
PcapBlockOwned::LegacyHeader(block) => {
|
||||
println!("dunnoheader");
|
||||
}
|
||||
PcapBlockOwned::NG(block) => {
|
||||
if block.is_data_block() {
|
||||
match block {
|
||||
Block::EnhancedPacket(ref epb) => {
|
||||
if epb.origlen == 6972 {
|
||||
// remove udp header
|
||||
data.push(epb.data[0x2a..].to_vec());
|
||||
}
|
||||
}
|
||||
Block::SimplePacket(ref ep) => {
|
||||
if ep.origlen == 6972 {
|
||||
println!("found one regular");
|
||||
}
|
||||
}
|
||||
_ => {
|
||||
println!("unsupported packet");
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
cap.consume(offset)
|
||||
}
|
||||
Err(PcapError::Eof) => break,
|
||||
|
@ -25,6 +54,7 @@ fn main() -> anyhow::Result<()> {
|
|||
}
|
||||
}
|
||||
}
|
||||
println!("found {} packets, {} size", i, size);
|
||||
println!("found {} packets, saved {}, {} size", i, data.len(), size);
|
||||
println!("{:+?}", data);
|
||||
Ok(())
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue
Block a user