PcapFileEx.Format (pcap_file_ex v0.5.5)

View Source

File format detection for PCAP and PCAPNG files.

This module provides unified format detection by reading the magic number (first 4 bytes) from packet capture files.

Supported Formats

  • PCAP (microsecond precision): Little-endian and big-endian
  • PCAP (nanosecond precision): Little-endian and big-endian
  • PCAPNG: Next-generation packet capture format

Examples

# Detect file format
PcapFileEx.Format.detect("capture.pcap")
#=> :pcap

PcapFileEx.Format.detect("capture.pcapng")
#=> :pcapng

# Handle errors
PcapFileEx.Format.detect("nonexistent.pcap")
#=> {:error, "Cannot open file: no such file or directory"}

PcapFileEx.Format.detect("empty.pcap")
#=> {:error, "File is empty"}

Summary

Functions

detect(path)

Detects the format of a packet capture file by reading its magic number.

Functions

detect(path)

@spec detect(Path.t()) :: :pcap | :pcapng | {:error, String.t()}

Detects the format of a packet capture file by reading its magic number.

Parameters

  • path - Path to the packet capture file

Returns

  • :pcap - File is in PCAP format (microsecond or nanosecond precision)
  • :pcapng - File is in PCAPNG format
  • {:error, reason} - File cannot be read or has unknown format

Examples

iex> PcapFileEx.Format.detect("test/fixtures/http.pcap")
:pcap

iex> PcapFileEx.Format.detect("test/fixtures/dns.pcapng")
:pcapng

iex> PcapFileEx.Format.detect("nonexistent.pcap")
{:error, "Cannot open file: no such file or directory"}