pcapng: add helpers to get the most common options for ISB

Author: chifflier

examples/pcap-info.rs

@@ -106,6 +106,33 @@ fn print_block_info_ng(block: &Block) {
  println!("\t\t\tif_tsoffset: {}", option.unwrap_or(0));
  }
  }
+ Block::InterfaceStatistics(isb) => {
+ println!("\t\tStatistics:");
+ if let Some(option) = isb.isb_starttime() {
+ let (ts_high, ts_low) = option.unwrap_or((0, 0));
+ println!("\t\t\tisb_starttime: 0x{:x}:0x{:x}", ts_high, ts_low);
+ // to decode, this require the ts_offset and resolution from the matching IDB block
+ // for ex:
+ // let resolution = build_ts_resolution(6).unwrap();
+ // let ts = build_ts(ts_high, ts_low, 0, resolution);
+ // println!("\t\t\t\t{}.{}", ts.0, ts.1);
+ }
+ if let Some(option) = isb.isb_ifrecv() {
+ println!("\t\t\tisb_ifrecv: {}", option.unwrap_or(0));
+ }
+ if let Some(option) = isb.isb_ifdrop() {
+ println!("\t\t\tisb_ifdrop: {}", option.unwrap_or(0));
+ }
+ if let Some(option) = isb.isb_filteraccept() {
+ println!("\t\t\tisb_filteraccept: {}", option.unwrap_or(0));
+ }
+ if let Some(option) = isb.isb_osdrop() {
+ println!("\t\t\tisb_osdrop: {}", option.unwrap_or(0));
+ }
+ if let Some(option) = isb.isb_usrdeliv() {
+ println!("\t\t\tisb_usrdeliv: {}", option.unwrap_or(0));
+ }
+ }
  _ => (),
  }
 }

src/pcapng/interface_statistics.rs

@@ -17,6 +17,86 @@ pub struct InterfaceStatisticsBlock<'a> {
  pub block_len2: u32,
 }
 
+impl<'a> InterfaceStatisticsBlock<'a> {
+ /// Return the `isb_starttime` option value, if present
+ ///
+ /// The returned value is `(ts_high,ts_low)`. To convert to a full timestamp,
+ /// use the [build_ts] function with the `ts_offset` and `resolution` values from
+ /// the `InterfaceDescriptionBlock` matching `self.if_id`.
+ ///
+ /// If the option is present multiple times, the first value is returned.
+ ///
+ /// Returns `None` if option is not present, `Some(Ok(value))` if the value is present and valid,
+ /// or `Some(Err(_))` if value is present but invalid
+ pub fn isb_starttime(&self) -> Option<Result<(u32, u32), PcapNGOptionError>> {
+ options_get_as_ts(&self.options, OptionCode::IsbStartTime)
+ }
+
+ /// Return the `isb_endtime` option value, if present
+ ///
+ /// The returned value is `(ts_high,ts_low)`. To convert to a full timestamp,
+ /// use the [build_ts] function with the `ts_offset` and `resolution` values from
+ /// the `InterfaceDescriptionBlock` matching `self.if_id`.
+ ///
+ /// If the option is present multiple times, the first value is returned.
+ ///
+ /// Returns `None` if option is not present, `Some(Ok(value))` if the value is present and valid,
+ /// or `Some(Err(_))` if value is present but invalid
+ pub fn isb_endtime(&self) -> Option<Result<(u32, u32), PcapNGOptionError>> {
+ options_get_as_ts(&self.options, OptionCode::IsbEndTime)
+ }
+
+ /// Return the `isb_ifrecv` option value, if present
+ ///
+ /// If the option is present multiple times, the first value is returned.
+ ///
+ /// Returns `None` if option is not present, `Some(Ok(value))` if the value is present and valid,
+ /// or `Some(Err(_))` if value is present but invalid
+ pub fn isb_ifrecv(&self) -> Option<Result<u64, PcapNGOptionError>> {
+ options_get_as_u64_le(&self.options, OptionCode::IsbIfRecv)
+ }
+
+ /// Return the `isb_ifdrop` option value, if present
+ ///
+ /// If the option is present multiple times, the first value is returned.
+ ///
+ /// Returns `None` if option is not present, `Some(Ok(value))` if the value is present and valid,
+ /// or `Some(Err(_))` if value is present but invalid
+ pub fn isb_ifdrop(&self) -> Option<Result<u64, PcapNGOptionError>> {
+ options_get_as_u64_le(&self.options, OptionCode::IsbIfDrop)
+ }
+
+ /// Return the `isb_filteraccept` option value, if present
+ ///
+ /// If the option is present multiple times, the first value is returned.
+ ///
+ /// Returns `None` if option is not present, `Some(Ok(value))` if the value is present and valid,
+ /// or `Some(Err(_))` if value is present but invalid
+ pub fn isb_filteraccept(&self) -> Option<Result<u64, PcapNGOptionError>> {
+ options_get_as_u64_le(&self.options, OptionCode::IsbFilterAccept)
+ }
+
+ /// Return the `isb_osdrop` option value, if present
+ ///
+ /// If the option is present multiple times, the first value is returned.
+ ///
+ /// Returns `None` if option is not present, `Some(Ok(value))` if the value is present and valid,
+ /// or `Some(Err(_))` if value is present but invalid
+ pub fn isb_osdrop(&self) -> Option<Result<u64, PcapNGOptionError>> {
+ options_get_as_u64_le(&self.options, OptionCode::IsbOsDrop)
+ }
+
+ /// Return the `isb_usrdeliv` option value, if present
+ ///
+ /// If the option is present multiple times, the first value is returned.
+ ///
+ /// Returns `None` if option is not present, `Some(Ok(value))` if the value is present and valid,
+ /// or `Some(Err(_))` if value is present but invalid
+ pub fn isb_usrdeliv(&self) -> Option<Result<u64, PcapNGOptionError>> {
+ options_get_as_u64_le(&self.options, OptionCode::IsbUsrDeliv)
+ }
+}
+
 impl<'a, En: PcapEndianness> PcapNGBlockParser<'a, En, InterfaceStatisticsBlock<'a>>
  for InterfaceStatisticsBlock<'a>
 {

src/pcapng/option.rs

@@ -19,13 +19,20 @@ impl debug OptionCode {
  Comment = 1,
  ShbHardware = 2,
  IfName = 2,
+ IsbStartTime = 2,
  ShbOs = 3,
  IfDescription = 3,
+ IsbEndTime = 3,
  ShbUserAppl = 4,
  IfIpv4Addr = 4,
+ IsbIfRecv = 4,
+ IsbIfDrop = 5,
  IfMacAddr = 6,
+ IsbFilterAccept = 6,
  IfEuiAddr = 7,
+ IsbOsDrop = 7,
  IfSpeed = 8,
+ IsbUsrDeliv = 8,
  IfTsresol = 9,
  IfFilter = 11,
  IfOs = 12,
@@ -247,3 +254,23 @@ pub(crate) fn options_get_as_u64_le(
 ) -> Option<Result<u64, PcapNGOptionError>> {
  options_find_map(options, code, |opt| opt.as_u64_le())
 }
+
+pub(crate) fn options_get_as_ts(
+ options: &[PcapNGOption],
+ code: OptionCode,
+) -> Option<Result<(u32, u32), PcapNGOptionError>> {
+ options_find_map(options, code, |opt| {
+ let value = opt.value();
+ if opt.len == 8 && value.len() == 8 {
+ let bytes_ts_high =
+ <[u8; 4]>::try_from(&value[..4]).or(Err(PcapNGOptionError::InvalidLength))?;
+ let bytes_ts_low =
+ <[u8; 4]>::try_from(&value[4..8]).or(Err(PcapNGOptionError::InvalidLength))?;
+ let ts_high = u32::from_le_bytes(bytes_ts_high);
+ let ts_low = u32::from_le_bytes(bytes_ts_low);
+ Ok((ts_high, ts_low))
+ } else {
+ Err(PcapNGOptionError::InvalidLength)
+ }
+ })
+}