dnsjit.input.fpcap(3)

💖 dnsjit.input.fpcap — the manual, but make it cute 💖

ok so bestie, this is dnsjit.input.fpcap(3) from the dnsjit library functions manual and it's literally just "read a PCAP file, but with fopen() energy instead of libpcap energy". Let's get into it 🫶

---

✨ NAME ✨

dnsjit.input.fpcap — Read input from a PCAP file using fopen()

---

🌸 SYNOPSIS 🌸

local input = require("dnsjit.input.fpcap").new()
input:open("file.pcap")
input:receiver(filter_or_output)
input:run()

like... that's the whole vibe. three lines and you're eating 🍓

---

🦋 DESCRIPTION 🦋

So here's the tea: this reads input from a PCAP file using the standard library function fopen(), and it parses the PCAP without libpcap. No cap. Once you've opened a file and read the PCAP header, the attributes get populated. Iconic behaviour honestly 👑

🎀 Attributes 🎀

• is_swapped — Says whether the byte order in the PCAP is in reverse order of the host. yes she's checking if things are backwards 🙈
• is_nanosec — Says whether the time stamps are in nanoseconds or not. nano-girlies know 💅
• magic_number — The magic number. ✨ magic ✨
• version_major — Major version number.
• version_minor — Minor version number.
• thiszone — GMT to local correction.
• sigfigs — Accuracy of timestamps.
• snaplen — Max length of captured packets, in octets.
• network — The link type found in the PCAP header, see https://www.tcpdump.org/linktypes.html . go look it up bestie, it's giving reference material 🔥
• linktype — The data link type, mapped from network.

⭐ Functions ⭐

• Fpcap.new() — Create a new Fpcap input. fresh start, main character energy ✨
• Fpcap:log() — Return the Log object to control logging of this instance or module. for when you need to journal about it 📓
• Fpcap:receiver(o) — Set the receiver to pass objects to. like handing the aux cord to someone you trust 🎧
• Fpcap:produce() — Return the C functions and context for producing objects.
• Fpcap:fadvise_sequential() — Use posix_fadvise() to indicate sequential reading (if supported), may increase performance. MUST be called before open(). 🚨 not me stressing this — it literally MUST be before open(), so do not skip that part.
• Fpcap:open(file) — Open a PCAP file for processing and read the PCAP header. Returns 0 on success. zero means slay 💖
• Fpcap:openfp(fp) — Open a PCAP file for processing and read the PCAP header using a file descriptor, for example io.stdin or with io.open(). Will not take ownership of the file descriptor. Returns 0 on success. so like, the fd is still yours, don't come for her 🫶
• Fpcap:run() — Start processing packets and send each packet read to the receiver. Returns 0 if all packets was read successfully. run it up, it's giving productive 🌈
• Fpcap:packets() — Return the number of packets seen. she's been counting. always counting. 👀

---

💜 AUTHORS and CONTRIBUTORS 💜

Jerry Lundström (DNS-OARC), Tomáš Křížek (CZ.NIC), Petr Špaček (ISC)

Maintained by DNS-OARC

https://www.dns-oarc.net/

the way these people built this... legends only, periodt 👑

---

💀 BUGS 💀

For issues and feature requests please use:

https://codeberg.org/DNS-OARC/dnsjit/issues

For question and help please use:

admin@dns-oarc.net

ngl if something's broken, tell them, they're nice about it 😭

---

and that's the whole page bestie, no notes 🎀 this was dnsjit.input.fpcap(3) from dnsjit version 1.5.1 — big love to DNS-OARC for keeping it cute and maintained, mwah 💋