dnsjit.input.zmmpcap(3)

💖 dnsjit.input.zmmpcap — Library Functions Manual 💖

okay bestie, gather round, because this one is a whole mood. this is dnsjit.input.zmmpcap(3), and she reads input from a PCAP file using mmap(). yes. mmap. she's that girl. 🦋

---

✨ NAME ✨

dnsjit.input.zmmpcap — Read input from a PCAP file using mmap()

---

✨ SYNOPSIS ✨

local input = require("dnsjit.input.zmmpcap").new()
input:zstd()
input:open("file.pcap.zst")
input:receiver(filter_or_output)
input:run()

like. look at her. five lines and she's already eating. 💅

---

✨ DESCRIPTION ✨

so basically? she reads input from a PCAP file by mapping the whole entire file into memory using mmap() — no cap, the whole thing — and then she parses the PCAP without libpcap. not a single libpcap in sight. iconic behaviour, honestly.

and then — after you open a file and read the PCAP header — the attributes get populated. she fills herself in. main character energy. 👑

🌸 Attributes 🌸

• is_swapped — tells you if the byte order in the PCAP is in reverse order of the host. backwards byte order? she clocks it. 🙈
• is_nanosec — tells you whether the time stamps are in nanoseconds or not. nanosecond girlies vs the rest of us.
• magic_number — the magic number. ✨ literally what it says on the tin.
• version_major — the major version number.
• version_minor — the minor version number.
• thiszone — GMT to local correction.
• sigfigs — accuracy of timestamps.
• snaplen — max length of captured packets, in octets.
• network — the link type found in the PCAP header, see https://www.tcpdump.org/linktypes.html. go look, i'll wait. 🫶
• linktype — the data link type, mapped from network. it's giving "derived field", lowkey.

🎀 Functions 🎀

• Zmmpcap.new() — Create a new Zmmpcap input. fresh start, new you. ✨
• Zmmpcap:log() — Return the Log object to control logging of this instance or module. she keeps receipts. 📝
• Zmmpcap:receiver(o) — Set the receiver to pass objects to.
• Zmmpcap:produce() — Return the C functions and context for producing objects.
• Zmmpcap:lz4() — Use liblz4 to decompress the input file/data.
• Zmmpcap:zstd() — Use libzstd to decompress the input file/data.
• Zmmpcap:gzip() — Use zlib/gzip to decompress the input file/data.
• Zmmpcap:lzma() — Use liblzma/xz to decompress the input file/data.
• Zmmpcap:have_support() — Return true if support for selected compression library is built in. (bestie, check this before you get your hopes up. 😭)
• Zmmpcap:open(file) — Open a PCAP file for processing and read the PCAP header. Returns 0 on success.
• Zmmpcap:run() — Start processing packets and send each packet read to the receiver. Returns 0 if all packets was read successfully.
• Zmmpcap:packets() — Return the number of packets seen. she's been counting. 👀

ngl the return values matter here: 0 means success, on both open() and run(). don't sleep on that. 💀

---

💜 AUTHORS and CONTRIBUTORS 💜

Jerry Lundström (DNS-OARC), Tomáš Křížek (CZ.NIC), Petr Špaček (ISC)

Maintained by DNS-OARC

https://www.dns-oarc.net/

legends, all of them. periodt. 👑

---

🌈 BUGS 🌈

found a bug? want a feature? first of all, thank you for your service. 🫡

For issues and feature requests please use:

https://codeberg.org/DNS-OARC/dnsjit/issues

For question and help please use:

admin@dns-oarc.net

they're nice, i promise. go say hi. 💖

---

and that's the whole page, bestie — you read it, you understood it, you slayed it. 🧚 this was dnsjit.input.zmmpcap(3) from dnsjit 1.5.1, dated dnsjit.input.zmmpcap(3) (yes the footer said the same name twice, she's consistent and we love that for her). go map some files to memory. 🦋✨💅