dnsjit.input.zpcap(3)

💖 dnsjit.input.zpcap — the manual page, but make it cute 💖

okay bestie, so this is dnsjit.input.zpcap(3) from the Library Functions Manual, and it's genuinely one of my faves because it's giving "compressed PCAP? no problem, we don't even need libpcap" energy. sit with me, we're gonna go through the whole thing, every single flag, no skipping, periodt. 🦋

---

✨ NAME ✨

dnsjit.input.zpcap — read input from a PCAP file that is compressed. yes, compressed. zstd, lz4, gzip, lzma, she contains multitudes 💅

---

🎀 SYNOPSIS 🎀

local input = require("dnsjit.input.zpcap").new()
input:zstd()
input:open("file.pcap.zst")
input:receiver(filter_or_output)
input:run()

look at her. pick a decompressor, open the file, set a receiver, run. that's the whole vibe. 🌸

---

🌈 DESCRIPTION 🌈

So basically: you read input from a PCAP file that is compressed, and then she parses the PCAP without libpcap. no libpcap needed, she said what she said. 🔥

Once you've opened a file and read the PCAP header, the attributes get populated. that's the moment. the main character moment. 👑

💜 Attributes 💜

• is_swapped — tells you if the byte order in the PCAP is in reverse order of the host. little endian/big endian drama, iykyk.
• is_nanosec — tells you if the time stamps are in nanoseconds or not. nano girlies rise 🫶
• magic_number — the magic number. iconic, obviously. ✨
• version_major — major version number.
• version_minor — minor version number.
• thiszone — GMT to local correction.
• sigfigs — accuracy of timestamps.
• snaplen — max length of captured packets, in octets.
• network — the link type found in the PCAP header, see <https://www.tcpdump.org/linktypes.html> — wait no links bestie, just go look at https://www.tcpdump.org/linktypes.html yourself 😭
• linktype — the data link type, mapped from network. so network walked so linktype could run 💅

🌟 Functions 🌟

• Zpcap.new() — create a new Zpcap input. the birth of a legend.
• Zpcap:log() — return the Log object, so you can control logging of this instance or module. she's transparent, she journals 📓
• Zpcap:receiver(o) — set the receiver to pass objects to. who's she sending her packets to? you decide.
• Zpcap:produce() — return the C functions and context for producing objects.
• Zpcap:fadvise_sequential() — use posix_fadvise() to indicate sequential reading (if supported), which may increase performance. ⚠️ MUST be called before open() — like, before before. if you do it after, that's on you bestie, she told you.
• Zpcap:lz4() — use liblz4 to decompress the input file/data.
• Zpcap:zstd() — use libzstd to decompress the input file/data. zstd girlies, this is our moment 🎀
• Zpcap:gzip() — use zlib/gzip to decompress the input file/data.
• Zpcap:lzma() — use liblzma/xz to decompress the input file/data.
• Zpcap:have_support() — return true if support for the selected compression library is built in. vibe check on your build 🔍
• Zpcap:open(file) — open a PCAP file for processing and read the PCAP header. returns 0 on success. we love a zero 🫶
• Zpcap:openfp(fp) — open a PCAP file for processing and read the PCAP header using a file descriptor, for example io.stdin or with io.open(). Will not take ownership of the file descriptor (she's not possessive, she respects boundaries 💜). returns 0 on success.
• Zpcap:run() — start processing packets and send each packet read to the receiver. returns 0 if all packets were read successfully. slay.
• Zpcap:packets() — return the number of packets seen. counting her blessings fr fr ✨

---

👀 SEE ALSO 👀

• dnsjit.input.fpcap(3) — her uncompressed sibling, go say hi

---

🌸 AUTHORS and CONTRIBUTORS 🌸

Shoutout to the absolute legends who made this:

• Jerry Lundström (DNS-OARC)
• Tomáš Křížek (CZ.NIC)
• Petr Špaček (ISC)

Maintained by DNS-OARC 🫶

https://www.dns-oarc.net/

---

💀 BUGS 💀

Found a bug? Need a feature? Not me being the bearer of bad news, but:

for issues and feature requests please use:

https://codeberg.org/DNS-OARC/dnsjit/issues

got questions, need help, just wanna chat:

admin@dns-oarc.net

---

and that's the whole page bestie, no cap, every flag accounted for 💅 this was dnsjit.input.zpcap(3) from dnsjit version 1.5.1 — go decompress something iconic, ily, bye 🎀✨🦋