Package jnetpcap.capture.file

Allows full access to capture file structure.

See:
Description

Interface Summary

BlockRecord	A block record also sometimes refered to a file header in a capture file which uniquely identifies the file as certain type with a magic pattern or magic number.
DataRecord	Data record is a record in a capture file that belongs to one block record, a parent/child relationship, and contains some kind of data.
MutableBlockRecord	Extends the immutable BlockRecord interface and adds methods for adding, removing, moving and seeking file records.
MutableRecordIterator<T extends Record>	Iterator which extends the basic immutable RecordIterator and add methods to add, remove, move or seek records in a capture file.
Record	A record within a capture file.
Record.RecordType	Interface that allows retrieval of type information about each impelementation specific record type.
RecordIterator<T extends Record>	An iterator that allows iteration over records contained in a capture file.

Enum Summary

PacketCounterModel	Defines different types of models, or algorithms that can be used to count packets in a capture file.
Record.Capability	Enum constants that describe certain capabilities and thus information a particular type of record may contain.
Record.RecordType.CommonRecordType	Interface that allows retrieval of type information about each impelementation specific record type.
SuppliedFileTypes	Defines enum constants for all the currently supported capture file types by the jNetPCAP capture framework.

Exception Summary

UnsupportCapabilityException

Thrown when a particular feature or capability is requested of a capture file and it is not supported.

Package jnetpcap.capture.file Description

Allows full access to capture file structure. There a number of capture file formats that are used to store captured packets inside a file. This package allows detailed access and traversal of the structure of each of these files.

The package provides a base set of interfaces for accessing the detailed structure of a capture file, further detail with supplied interfaces is supplied with the file definition itself in jnetpcap.file.type package. At this level within the API, some amount of knowledge about the file structure is needed. The amount is detail required is still small compared to the actual complexity of some of the file formats. The section below describes the abstracted representation of the capture file structure used by this package.

Representation of capture file structure

The structure of each capture file, as presented by this package is as follows:

• A capture file may contain 1 or more BlockRecords, sometimes also referred to as "file header". The BlockRecord usually contains information about the block such as unique ID field called the "Magic Pattern" or "Magic Number", block version information and some other meta information. For example Pcap and Snoop files contain only a single BlockRecord, but Nap file type usually contains more than one.
• A BlockRecord contains 0 or more DataRecords. BlockRecord is not of type DataRecord and thus may not be contained within another BlockRecord. The most common type of DataRecord is a PacketRecord, but other types exist as well for other formats.