dnsjit.core.object.pcap(3)

💖 dnsjit.core.object.pcap(3) — Library Functions Manual 💖

okay bestie, pull up a chair, we're talking about dnsjit.core.object.pcap from the dnsjit manual, section 3 (library functions, iykyk). this one is literally just a lil container, but she's important. 🫶

---

✨ NAME ✨

dnsjit.core.object.pcap — a container holding one single packet that got found inside a PCAP. that's her. that's the whole job. 💅

---

🌸 DESCRIPTION 🌸

so like. this object is the container of a PCAP packet, and she's carrying info from two places at once: stuff that came from the PCAP itself, and stuff from the pcap_pkthdr object that gets received for every single packet in the PCAP. two sources, one iconic little struct. main character energy fr fr. 👑

---

🎀 Attributes 🎀

these are her fields, her little personality traits:

• snaplen — max length of the saved portion of each packet.
• linktype — the data link type for the PCAP.
• ts — time stamp of this packet.
• caplen — length of the portion that's actually present.
• len — length of this packet (off wire, so the real full thing).
• bytes — a pointer to the packet.
• is_swapped — tells you if the byte order of the PCAP is different than the host's. this one is used in, for example, the Layer filter, so it can correctly parse null objects — because those get stored in the capturer's host byte order. so yeah, do not sleep on is_swapped, she matters. 🧚

---

🦋 Functions 🦋

the methods, the moves, the choreography:

• Pcap:type() — returns the textual type of the object.
• Pcap:prev() — returns the previous object.
• Pcap:cast() — casts the object to the underlining object module and returns it.
• Pcap:uncast() — casts the object to the generic object module and returns it.
• Pcap:copy() — makes a copy of the object and returns it.
• Pcap:free() — frees the object. ⚠️ should only be used on copies or on something that was otherwise allocated. do not be out here freeing things you don't own, bestie, that's a one-way ticket to chaos city. 💀

---

🌈 SEE ALSO 🌈

go read these next, they're all in the family:

• dnsjit.core.object(3)
• dnsjit.input.pcap(3)
• dnsjit.input.fpcap(3)
• dnsjit.input.mmpcap(3)
• dnsjit.filter.layer(3)
• dnsjit.output.pcap(3)

---

👑 AUTHORS and CONTRIBUTORS 👑

the legends who made this happen:

• Jerry Lundström (DNS-OARC)
• Tomáš Křížek (CZ.NIC)
• Petr Špaček (ISC)

maintained by DNS-OARC 💜

https://www.dns-oarc.net/

---

🙈 BUGS 🙈

found something cursed? want a feature? don't suffer in silence, go file it:

https://codeberg.org/DNS-OARC/dnsjit/issues

got questions or need a human? slide into the inbox:

admin@dns-oarc.net

---

and that's the whole page, bestie. this one's from dnsjit version 1.5.1, and it's the dnsjit.core.object.pcap(3) page — no cap. now go parse some packets responsibly. ✨🎀🦋💖