pcpp::PcapFileWriterDevice Class Reference

#include <PcapFileDevice.h>

Inheritance diagram for pcpp::PcapFileWriterDevice:

Public Member Functions
	PcapFileWriterDevice (const std::string &fileName, LinkLayerType linkLayerType=LINKTYPE_ETHERNET, bool nanosecondsPrecision=false)
	~PcapFileWriterDevice ()
bool	writePacket (RawPacket const &packet) override
bool	writePackets (const RawPacketVector &packets) override
FileTimestampPrecision	getTimestampPrecision () const
bool	open () override
bool	open (bool appendMode) override
void	close () override
void	flush ()
void	getStatistics (PcapStats &stats) const override
Public Member Functions inherited from pcpp::IFileWriterDevice
virtual	~IFileWriterDevice ()
Public Member Functions inherited from pcpp::IFileDevice
std::string	getFileName () const
Public Member Functions inherited from pcpp::IPcapDevice
virtual bool	setFilter (std::string filterAsString)
bool	clearFilter ()
virtual bool	setFilter (GeneralFilter &filter)
virtual bool	setFilter (std::string filterAsString)=0
Public Member Functions inherited from pcpp::IDevice
bool	isOpened ()
Public Member Functions inherited from pcpp::IFilterableDevice
virtual bool	setFilter (GeneralFilter &filter)

Static Public Member Functions
static bool	isNanoSecondPrecisionSupported ()
Static Public Member Functions inherited from pcpp::IPcapDevice
static std::string	getPcapLibVersionInfo ()
static bool	matchPacketWithFilter (GeneralFilter &filter, RawPacket *rawPacket)

Detailed Description

A class for opening a pcap file for writing or create a new pcap file and write packets to it. This class adds a unique capability that isn't supported in WinPcap and in older libpcap versions which is to open a pcap file in append mode where packets are written at the end of the pcap file instead of running it over

Constructor & Destructor Documentation

PcapFileWriterDevice()

pcpp::PcapFileWriterDevice::PcapFileWriterDevice	(	const std::string &	fileName,
		LinkLayerType	linkLayerType = LINKTYPE_ETHERNET,
		bool	nanosecondsPrecision = false
	)

A constructor for this class that gets the pcap full path file name to open for writing or create. Notice that after calling this constructor the file isn't opened yet, so writing packets will fail. For opening the file call open()

Parameters

[in]	fileName	The full path of the file
[in]	linkLayerType	The link layer type all packet in this file will be based on. The default is Ethernet
[in]	nanosecondsPrecision	A boolean indicating whether to write timestamps in nano-precision. If set to false, timestamps will be written in micro-precision

~PcapFileWriterDevice()

pcpp::PcapFileWriterDevice::~PcapFileWriterDevice ( )

inline

A destructor for this class

Member Function Documentation

close()

void pcpp::PcapFileWriterDevice::close ( )

overridevirtual

Flush and close the pacp file

Reimplemented from pcpp::IFileDevice.

flush()

void pcpp::PcapFileWriterDevice::flush

(

)

Flush packets to disk.

getStatistics()

void pcpp::PcapFileWriterDevice::getStatistics ( PcapStats &  stats ) const

overridevirtual

Get statistics of packets written so far.

Parameters

[out]

stats

The stats struct where stats are returned

Implements pcpp::IPcapDevice.

getTimestampPrecision()

FileTimestampPrecision pcpp::PcapFileWriterDevice::getTimestampPrecision ( ) const

inline

Returns

The precision of the timestamps in the file.

isNanoSecondPrecisionSupported()

static bool pcpp::PcapFileWriterDevice::isNanoSecondPrecisionSupported ( )

static

A static method that checks if nano-second precision is supported in the current platform and environment

Returns

True if nano-second precision is supported, false otherwise

open() [1/2]

bool pcpp::PcapFileWriterDevice::open ( )

overridevirtual

Open the file in a write mode. If file doesn't exist, it will be created. If it does exist it will be overwritten, meaning all its current content will be deleted

Returns

True if file was opened/created successfully or if file is already opened. False if opening the file failed for some reason (an error will be printed to log)

Implements pcpp::IDevice.

open() [2/2]

bool pcpp::PcapFileWriterDevice::open ( bool  appendMode )

overridevirtual

Same as open(), but enables to open the file in append mode in which packets will be appended to the file instead of overwrite its current content. In append mode file must exist, otherwise opening will fail

Parameters

[in]

appendMode

A boolean indicating whether to open the file in append mode or not. If set to false this method will act exactly like open(). If set to true, file will be opened in append mode

Returns

True of managed to open the file successfully. In case appendMode is set to true, false will be returned if file wasn't found or couldn't be read, if file type is not pcap, or if link type specified in c'tor is different from current file link type. In case appendMode is set to false, please refer to open() for return values

Implements pcpp::IFileWriterDevice.

writePacket()

bool pcpp::PcapFileWriterDevice::writePacket ( RawPacket const &  packet )

overridevirtual

Write a RawPacket to the file. Before using this method please verify the file is opened using open(). This method won't change the written packet

Parameters

[in]

packet

A reference for an existing RawPcket to write to the file

Returns

True if a packet was written successfully. False will be returned if the file isn't opened or if the packet link layer type is different than the one defined for the file (in all cases, an error will be printed to log)

Implements pcpp::IFileWriterDevice.

writePackets()

bool pcpp::PcapFileWriterDevice::writePackets ( const RawPacketVector &  packets )

overridevirtual

Write multiple RawPacket to the file. Before using this method please verify the file is opened using open(). This method won't change the written packets or the RawPacketVector instance

Parameters

[in]

packets

A reference for an existing RawPcketVector, all of its packets will be written to the file

Returns

True if all packets were written successfully to the file. False will be returned if the file isn't opened (also, an error log will be printed) or if at least one of the packets wasn't written successfully to the file

Implements pcpp::IFileWriterDevice.