dnsjit.input.pcap(3)

💖 dnsjit.input.pcap 💖

okay bestie, welcome to dnsjit.input.pcap(3) — yes that's the whole manual name, we're being ✨official✨ — and this is the module that snatches packets straight off an interface or out of a PCAP file using libpcap. it's giving main character energy for your packet pipeline, fr fr.

---

✨ SYNOPSIS ✨

local input = require("dnsjit.input.pcap").new()
input:open_offline("file.pcap")
input:receiver(filter_or_output)
input:run()

like, that's the whole vibe. three little lines and you're literally reading packets. obsessed. 🦋

---

🌸 DESCRIPTION 🌸

it's an input module, bestie. its whole job is reading packets from interfaces and PCAP files. that's it, that's the girlboss era. 💅

🎀 Functions 🎀

• Pcap.new() — make a brand new Pcap input. fresh start, new me, etc. ✨
• Pcap:log() — hands you the Log object so you can control logging for this instance or module. you do want logs, trust. 🔥
• Pcap:receiver(o) — set the receiver, i.e. the thing that receives all the objects it passes along. point it at your filter or your output, iykyk.
• Pcap:produce() — gives you back the C functions and the context for producing objects. very behind-the-scenes, very backstage pass. 🎟️
• Pcap:create(source) — open a live packet capture on source, where source is an interface name, or "any" on Linux, or "all" on BSD. important queen behavior: it must be activated before use. no activation, no packets. periodt.
• Pcap:activate() — activates that live packet capture. go read pcap_activate(3pcap) for more info and for all the possible return values, because there are several and you should lowkey know them. 🌈
• Pcap:open_offline(file) — opens a PCAP file for processing. check pcap_open_offline(3pcap) for the deets. returns 0 on success. zero equals slay. 💖
• Pcap:loop(cnt) — processes packets from a live capture or a savefile until cnt packets are processed. see pcap_loop(3pcap) for more info and possible return values. it will simply keep going until the count says stop. iconic.
• Pcap:dispatch(cnt) — same energy, different function: processes packets from a live capture or savefile until cnt packets are processed. see pcap_dispatch(3pcap) for more info and possible return values. 👑
• Pcap:packets() — returns the number of packets seen. the receipts, bestie. the literal receipts. 🧾
• Pcap:linktype() — returns the linktype of the opened PCAP. ✨
• Pcap:snaplen() — returns the snaplen of the opened PCAP. yes she's short for "snapshot length", no she will not be elaborating further. 🎀

---

🦋 SEE ALSO 🦋

• dnsjit.output.pcap(3) — the other half of the story, go read her too. 💜

---

👑 AUTHORS and CONTRIBUTORS 👑

absolute legends, no cap:

• Jerry Lundström (DNS-OARC)
• Tomáš Křížek (CZ.NIC)
• Petr Špaček (ISC)

maintained by DNS-OARC 🫶

https://www.dns-oarc.net/

---

💀 BUGS 💀

found something broken? want a feature? bestie, they want to hear about it:

https://codeberg.org/DNS-OARC/dnsjit/issues

got a question or just need a hand? slide into the inbox:

admin@dns-oarc.net

---

and that's the whole page, babe. this was dnsjit 1.5.1, page dnsjit.input.pcap(3) — go forth, capture some packets, and remember: activate before use. mwah. 💅✨🌸