pcpp::PcapNgFileReaderDevice Class Reference

#include <PcapFileDevice.h>

Inheritance diagram for pcpp::PcapNgFileReaderDevice:

Public Member Functions
	PcapNgFileReaderDevice (const std::string &fileName)
virtual	~PcapNgFileReaderDevice ()
	A destructor for this class.
std::string	getOS () const
std::string	getHardware () const
std::string	getCaptureApplication () const
std::string	getCaptureFileComment () const
bool	getNextPacket (RawPacket &rawPacket, std::string &packetComment)
bool	getNextPacket (RawPacket &rawPacket) override
bool	open () override
void	close () override
	Close the pacp-ng file.
Public Member Functions inherited from pcpp::IFileReaderDevice
virtual	~IFileReaderDevice ()=default
	A destructor for this class.
uint64_t	getFileSize () const
int	getNextPackets (RawPacketVector &packetVec, int numOfPacketsToRead=-1)
Public Member Functions inherited from pcpp::IFileDevice
std::string	getFileName () const
bool	isOpened () const override
void	getStatistics (PcapStats &stats) const override
	Get the statistics for this device. More...
Public Member Functions inherited from pcpp::IFilterableDevice
bool	setFilter (GeneralFilter &filter)
bool	setFilter (std::string const &filterAsString)
bool	clearFilter ()
Public Member Functions inherited from pcpp::IPcapStatisticsProvider
PcapStats	getStatistics () const
	Get statistics from the device. More...

Protected Member Functions
bool	doUpdateFilter (std::string const *filter) override
	Updates the filter on the device with a BPF string. More...
Protected Member Functions inherited from pcpp::IFileReaderDevice
	IFileReaderDevice (const std::string &fileName)
Protected Member Functions inherited from pcpp::IFileDevice
void	reportPacketProcessed (uint64_t numPackets=1)
	Report that packets were processed (read or written, depending on the device type). More...
void	reportPacketDropped (uint64_t numPackets=1)
	Report that packets were dropped (not read or not written, depending on the device type). More...
void	resetStatisticCounters ()
	Reset the internal statistic counters to zero.

Additional Inherited Members
Static Public Member Functions inherited from pcpp::IFileReaderDevice
static IFileReaderDevice *	getReader (const std::string &fileName)
Static Public Member Functions inherited from pcpp::IPcapDevice
static std::string	getPcapLibVersionInfo ()
static bool	matchPacketWithFilter (GeneralFilter &filter, RawPacket *rawPacket)

Detailed Description

A class for opening a pcap-ng file in read-only mode. This class enable to open the file and read all packets, packet-by-packet

Constructor & Destructor Documentation

PcapNgFileReaderDevice()

pcpp::PcapNgFileReaderDevice::PcapNgFileReaderDevice

(

const std::string &

fileName

)

A constructor for this class that gets the pcap-ng full path file name to open. Notice that after calling this constructor the file isn't opened yet, so reading packets will fail. For opening the file call open()

Parameters

[in]

fileName

The full path of the file to read

Member Function Documentation

doUpdateFilter()

bool pcpp::PcapNgFileReaderDevice::doUpdateFilter ( std::string const *  filterAsString )

overrideprotectedvirtual

Updates the filter on the device with a BPF string.

Only packets that match the filter should be processed by the device after this method is called. A nullptr should disable any existing filter on the device.

Parameters

filterAsString

A pointer to a string representing the filter in BPF syntax (http://biot.com/capstats/bpf.html).

Returns

True if the operation was successful, false otherwise.

Reimplemented from pcpp::IPcapDevice.

getCaptureApplication()

std::string pcpp::PcapNgFileReaderDevice::getCaptureApplication

(

)

const

The pcap-ng format allows storing metadata at the header of the file. Part of this metadata is a string specifying the capture application that was used for capturing the packets. This method reads this string from the metadata (if exists) and returns it

Returns

The capture application string if exists, or an empty string otherwise

getCaptureFileComment()

std::string pcpp::PcapNgFileReaderDevice::getCaptureFileComment

(

)

const

The pcap-ng format allows storing metadata at the header of the file. Part of this metadata is a string containing a user-defined comment (can be any string). This method reads this string from the metadata (if exists) and returns it

Returns

The comment written inside the file if exists, or an empty string otherwise

getHardware()

std::string pcpp::PcapNgFileReaderDevice::getHardware

(

)

const

The pcap-ng format allows storing metadata at the header of the file. Part of this metadata is a string specifying the hardware that was used for capturing the packets. This method reads this string from the metadata (if exists) and returns it

Returns

The hardware string if exists, or an empty string otherwise

getNextPacket() [1/2]

bool pcpp::PcapNgFileReaderDevice::getNextPacket ( RawPacket &  rawPacket )

overridevirtual

Read the next packet from the file. Before using this method please verify the file is opened using open()

Parameters

[out]

rawPacket

A reference for an empty RawPacket where the packet will be written

Returns

True if a packet was read successfully. False will be returned if the file isn't opened (also, an error log will be printed) or if reached end-of-file

Implements pcpp::IFileReaderDevice.

getNextPacket() [2/2]

bool pcpp::PcapNgFileReaderDevice::getNextPacket	(	RawPacket &	rawPacket,
		std::string &	packetComment
	)

The pcap-ng format allows storing a user-defined comment for every packet (besides the comment per-file). This method reads the next packet and the comment attached to it (if such comment exists), and returns them both

Parameters

[out]	rawPacket	A reference for an empty RawPacket where the packet will be written
[out]	packetComment	The comment attached to the packet or an empty string if no comment exists

Returns

True if a packet was read successfully. False will be returned if the file isn't opened (also, an error log will be printed) or if reached end-of-file

getOS()

std::string pcpp::PcapNgFileReaderDevice::getOS

(

)

const

The pcap-ng format allows storing metadata at the header of the file. Part of this metadata is a string specifying the operating system that was used for capturing the packets. This method reads this string from the metadata (if exists) and returns it

Returns

The operating system string if exists, or an empty string otherwise

open()

bool pcpp::PcapNgFileReaderDevice::open ( )

overridevirtual

Open the file name which path was specified in the constructor in a read-only mode

Returns

True if file was opened successfully or if file is already opened. False if opening the file failed for some reason (for example: file path does not exist)

Implements pcpp::IDevice.