pcap-file-tokio

Fork of the awesome pcap-file crate, modified to support tokio.

Provides parsers, readers and writers for Pcap and PcapNg files.

For Pcap files see the pcap module.

For PcapNg files see the pcapng module.

Documentation

https://docs.rs/pcap-file-tokio

Installation

This crate is on crates.io. Add it to your Cargo.toml:

toml [dependencies] pcap-file-tokio = "2.0.0-rc1"

Examples

PcapReader

```rust,norun use tokio::fs::File; use pcapfile_tokio::pcap::PcapReader;

[tokio::main]

async fn main() { let filein = File::open("test.pcap").await.expect("Error opening file"); let mut pcapreader = PcapReader::new(file_in).await.unwrap();

// Read test.pcap
while let Some(pkt) = pcap_reader.next_packet().await {
    //Check if there is no error
    let pkt = pkt.unwrap();

    //Do something
}

} ```

PcapNgReader

```rust,norun use tokio::fs::File; use pcapfile_tokio::pcapng::PcapNgReader;

[tokio::main]

async fn main() { let filein = File::open("test.pcapng").await.expect("Error opening file"); let mut pcapngreader = PcapNgReader::new(file_in).await.unwrap();

// Read test.pcapng
while let Some(block) = pcapng_reader.next_block().await {
    // Check if there is no error
    let block = block.unwrap();

    //  Do something
}

} ```

Fuzzing

Currently there are 4 crude harnesses to check that the parser won't panic in any situation. To start fuzzing you must install cargo-fuzz with the command: bash $ cargo install cargo-fuzz

And then, in the root of the repository, you can run the harnesses as: bash $ cargo fuzz run pcap_reader $ cargo fuzz run pcap_ng_reader $ cargo fuzz run pcap_parser $ cargo fuzz run pcap_ng_parser

Keep in mind that libfuzzer by default uses only one core, so you can either run all the harnesses in different terminals, or you can pass the -jobs and -workers attributes. More info can be found in its documentation here. To get better crash reports add to you rust flags: -Zsanitizer=address. E.g. bash RUSTFLAGS="-Zsanitizer=address" cargo fuzz run pcap_reader

License

Licensed under MIT.

Disclaimer

To test the library I used the excellent PcapNg testing suite provided by hadrielk.