pickles/pcap.pk


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73


/* Copyright (C) 2022, Mohammad-Reza Nabipoor */
/* SPDX-License-Identifier: GPL-3.0-or-later */

/* https://wiki.wireshark.org/Development/LibpcapFileFormat */

/* Global Header */
type PCAP_Header =
  struct
  {
    uint32 magic_number :
      get_endian == ENDIAN_LITTLE
        ? magic_number in [0xa1b2c3d4U, 0xa1b23cd4U]
        : magic_number in [0xd4c3b2a1U, 0xd43cb2a1U];
    uint16 version_major = 2;
    uint16 version_minor = 4;
    int32  thiszone; /* GMT to local correction */
    uint32 sigfigs;  /* accuracy of timestamps */
    uint32 snaplen;  /* max length of captured packets, in octets */
    uint32 network;  /* data link type */

    /* Nano-second resolution file? */
    method is_nsec_p = int:
      {
        return magic_number in [0xa1b23cd4U, 0xd43cb2a1U];
      }
    method get_endian = int:
      {
        return magic_number in [0xa1b2c3d4U, 0xa1b23cd4U] ? ENDIAN_LITTLE
                                                          : ENDIAN_BIG;
      }
  };

/* Packet (Record) Header */
type PCAP_PacketHeader =
  struct /* (int nsec_p) */
  {
    uint32 ts_sec;   /* timestamp seconds */
    uint32 ts_usec;  /* microseconds (or nanoseconds if `nsec_p`) */
    offset<uint32,B> incl_len;  /* number of octets of packet saved in file */
    offset<uint32,B> orig_len : /* actual length of packet */
      incl_len <= orig_len;

    method is_sliced_p = int:
      {
        return incl_len != orig_len;
      }
  };

type PCAP_Packet =
  struct
  {
    PCAP_PacketHeader header;

    var body_offset = OFFSET;
    var body_length = header.incl_len;

    byte[0] @ body_offset + body_length; /* End-of-packet marker */

    method get_body_offset = offset<uint32,B>: { return body_offset; }
    method get_body_length = offset<uint32,B>: { return body_length; }
    method get_body = byte[]:
      {
        return byte[body_length] @ body_offset;
      }
  };

type PCAP =
  struct
  {
    PCAP_Header header;
    PCAP_Packet[] packets;
  };