Package nl.sidnlabs.pcap

Class PcapReader

java.lang.Object

nl.sidnlabs.pcap.PcapReader

public class PcapReader
extends Object

Read all data from a pcap file and decode all the packets

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
protected static class	PcapReader.LinkType

Field Summary

Fields

Modifier and Type	Field	Description
static int	CAP_LEN_OFFSET
static int	DNS_PORT
static int	ETHERNET_HEADER_SIZE
static int	ETHERNET_TYPE_8021Q
static int	ETHERNET_TYPE_IP
static int	ETHERNET_TYPE_IPV6
static int	ETHERNET_TYPE_OFFSET
static int	HEADER_SIZE
static long	MAGIC_NUMBER
static int	PACKET_HEADER_SIZE
static int	PCAP_HEADER_LINKTYPE_OFFSET
static int	PROTOCOL_FRAGMENTED
static int	SLL_ADDRESS_LENGTH_OFFSET
static int	SLL_HEADER_BASE_SIZE
static int	TIMESTAMP_MICROS_OFFSET
static int	TIMESTAMP_OFFSET

Constructor Summary

Constructors

Constructor	Description
PcapReader(DataInputStream is, boolean tcpEnabled)

Method Summary

Modifier and Type	Method	Description
void	clearCache(int tcpCacheTTL, int ipCacheTTL)	Clear expired cache entries in order to avoid memory problems
void	close()
protected int	findIPStart(byte[] packet)
com.google.common.collect.Multimap<Datagram,DatagramPayload>	getDatagrams()
Map<TCPFlow,FlowData>	getFlows()
protected PcapReader.LinkType	getLinkType(long linkTypeVal)
protected boolean	readBytes(byte[] buf)
void	setDatagrams(com.google.common.collect.Multimap<Datagram,DatagramPayload> map)
void	setFlows(Map<TCPFlow,FlowData> flows)
Stream<Packet>	stream()
protected boolean	validateMagicNumber(byte[] pcapHeader)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

DNS_PORT

public static final int DNS_PORT

See Also:

Constant Field Values

MAGIC_NUMBER

public static final long MAGIC_NUMBER

See Also:

Constant Field Values

HEADER_SIZE

public static final int HEADER_SIZE

See Also:

Constant Field Values

PCAP_HEADER_LINKTYPE_OFFSET

public static final int PCAP_HEADER_LINKTYPE_OFFSET

See Also:

Constant Field Values

PACKET_HEADER_SIZE

public static final int PACKET_HEADER_SIZE

See Also:

Constant Field Values

TIMESTAMP_OFFSET

public static final int TIMESTAMP_OFFSET

See Also:

Constant Field Values

TIMESTAMP_MICROS_OFFSET

public static final int TIMESTAMP_MICROS_OFFSET

See Also:

Constant Field Values

CAP_LEN_OFFSET

public static final int CAP_LEN_OFFSET

See Also:

Constant Field Values

ETHERNET_HEADER_SIZE

public static final int ETHERNET_HEADER_SIZE

See Also:

Constant Field Values

ETHERNET_TYPE_OFFSET

public static final int ETHERNET_TYPE_OFFSET

See Also:

Constant Field Values

ETHERNET_TYPE_IP

public static final int ETHERNET_TYPE_IP

See Also:

Constant Field Values

ETHERNET_TYPE_IPV6

public static final int ETHERNET_TYPE_IPV6

See Also:

Constant Field Values

ETHERNET_TYPE_8021Q

public static final int ETHERNET_TYPE_8021Q

See Also:

Constant Field Values

SLL_HEADER_BASE_SIZE

public static final int SLL_HEADER_BASE_SIZE

See Also:

Constant Field Values

SLL_ADDRESS_LENGTH_OFFSET

public static final int SLL_ADDRESS_LENGTH_OFFSET

See Also:

Constant Field Values

PROTOCOL_FRAGMENTED

public static final int PROTOCOL_FRAGMENTED

See Also:

Constant Field Values

Constructor Detail

PcapReader

public PcapReader(DataInputStream is,
                  boolean tcpEnabled)
           throws IOException

Throws:

IOException

Method Detail

stream

public Stream<Packet> stream()

clearCache

public void clearCache(int tcpCacheTTL,
                       int ipCacheTTL)

Clear expired cache entries in order to avoid memory problems

Parameters:

tcpCacheTTL - timeout for tcp flows

ipCacheTTL - timeout for IP fragments

close

public void close()

validateMagicNumber

protected boolean validateMagicNumber(byte[] pcapHeader)

getLinkType

protected PcapReader.LinkType getLinkType(long linkTypeVal)

findIPStart

protected int findIPStart(byte[] packet)

readBytes

protected boolean readBytes(byte[] buf)

getFlows

public Map<TCPFlow,FlowData> getFlows()

setFlows

public void setFlows(Map<TCPFlow,FlowData> flows)

getDatagrams

public com.google.common.collect.Multimap<Datagram,DatagramPayload> getDatagrams()

setDatagrams

public void setDatagrams(com.google.common.collect.Multimap<Datagram,DatagramPayload> map)