51 lines
1.5 KiB
C
51 lines
1.5 KiB
C
/**
|
|
* @file pcap_serializer.h
|
|
* @brief PCAP file format serializer for Wireshark compatibility
|
|
*/
|
|
#ifndef PCAP_SERIALIZER_H
|
|
#define PCAP_SERIALIZER_H
|
|
|
|
#include <stdint.h>
|
|
|
|
// PCAP Global Header
|
|
typedef struct __attribute__((packed)) {
|
|
uint32_t magic_number; // 0xa1b2c3d4
|
|
uint16_t version_major; // 2
|
|
uint16_t version_minor; // 4
|
|
int32_t thiszone; // GMT offset (usually 0)
|
|
uint32_t sigfigs; // Timestamp accuracy
|
|
uint32_t snaplen; // Max packet length
|
|
uint32_t network; // Link-layer type
|
|
} pcap_global_header_t;
|
|
|
|
// PCAP Packet Header
|
|
typedef struct __attribute__((packed)) {
|
|
uint32_t ts_sec; // Timestamp seconds
|
|
uint32_t ts_usec; // Timestamp microseconds
|
|
uint32_t incl_len; // Captured length
|
|
uint32_t orig_len; // Original length
|
|
} pcap_record_header_t;
|
|
|
|
// Initialize PCAP serializer
|
|
uint8_t* pcap_serializer_init(void);
|
|
|
|
// Append a captured frame to PCAP buffer
|
|
void pcap_serializer_append_frame(const uint8_t *buffer, unsigned size, unsigned ts_usec);
|
|
|
|
// Deinitialize and free PCAP buffer
|
|
void pcap_serializer_deinit(void);
|
|
|
|
// Get current PCAP buffer size
|
|
unsigned pcap_serializer_get_size(void);
|
|
|
|
// Get PCAP buffer pointer
|
|
uint8_t* pcap_serializer_get_buffer(void);
|
|
|
|
// Reset PCAP buffer (keep header, clear packets)
|
|
void pcap_serializer_reset(void);
|
|
|
|
// Get number of packets in buffer
|
|
unsigned pcap_serializer_get_packet_count(void);
|
|
|
|
#endif // PCAP_SERIALIZER_H
|