libpcap file framing - the classic global + per-record headers, link-type agnostic. More...

#include "endian/endian.h"
#include "protocore_config.h"

Classes
struct	PcapArgs
	Where a header is written, and the link type the file declares. More...

struct	PcapRecArgs
	What one captured frame's record header states. More...

struct	PcapVars

struct	PcapNs
	The entries. More...

Macros
#define	PROTOCORE_PCAP_GLOBAL_HDR_LEN 24
	libpcap header sizes.

#define	PROTOCORE_PCAP_REC_HDR_LEN 16

#define	PROTOCORE_DLT_IEEE802_11 105
	Common libpcap DLT link-layer types.

#define	PROTOCORE_DLT_CAN_SOCKETCAN 227
	Linux SocketCAN classic/FD frames.

#define	PROTOCORE_DLT_ETHERNET 1
	IEEE 802.3 Ethernet.

#define	PROTOCORE_DLT_IEEE802_15_4_NOFCS 230
	raw 802.15.4 MAC frame, no FCS

#define	PROTOCORE_DLT_IEEE802_15_4_TAP 283
	802.15.4 with a TAP pseudo-header (RSSI / channel TLVs)

#define	PROTOCORE_DLT_RAW 101
	the record starts at the IP header, with no link layer

Functions
void	protocore_pcap_global_header (uint8_t *work)

void	protocore_pcap_record_header (uint8_t *work)

Variables
PcapVars	PcapV
	The operands and the outcome.

Detailed Description

libpcap file framing - the classic global + per-record headers, link-type agnostic.

One owner for the PCAP framing shared by every capture feature (Wi-Fi promiscuous capture, CAN / bus listen-only capture, ...): each writes its frames with the matching DLT link type so the forwarded stream is a valid .pcap a wired Wireshark / tcpdump opens directly. Header-only and pure (little-endian byte writes, no heap, no stdlib), host-identical.

Author: Douglas Quigg (dstroy0)

Date: 2026

Definition in file pcap.h.

Macro Definition Documentation

◆ PROTOCORE_PCAP_GLOBAL_HDR_LEN

#define PROTOCORE_PCAP_GLOBAL_HDR_LEN 24

libpcap header sizes.

Definition at line 25 of file pcap.h.

◆ PROTOCORE_PCAP_REC_HDR_LEN

#define PROTOCORE_PCAP_REC_HDR_LEN 16

Definition at line 26 of file pcap.h.

◆ PROTOCORE_DLT_IEEE802_11

#define PROTOCORE_DLT_IEEE802_11 105

Common libpcap DLT link-layer types.

raw 802.11 (Wi-Fi promiscuous capture)

Definition at line 29 of file pcap.h.

◆ PROTOCORE_DLT_CAN_SOCKETCAN

#define PROTOCORE_DLT_CAN_SOCKETCAN 227

Linux SocketCAN classic/FD frames.

Definition at line 30 of file pcap.h.

◆ PROTOCORE_DLT_ETHERNET

#define PROTOCORE_DLT_ETHERNET 1

IEEE 802.3 Ethernet.

Definition at line 31 of file pcap.h.

◆ PROTOCORE_DLT_IEEE802_15_4_NOFCS

#define PROTOCORE_DLT_IEEE802_15_4_NOFCS 230

raw 802.15.4 MAC frame, no FCS

Definition at line 32 of file pcap.h.

◆ PROTOCORE_DLT_IEEE802_15_4_TAP

#define PROTOCORE_DLT_IEEE802_15_4_TAP 283

802.15.4 with a TAP pseudo-header (RSSI / channel TLVs)

Definition at line 33 of file pcap.h.

◆ PROTOCORE_DLT_RAW

#define PROTOCORE_DLT_RAW 101

the record starts at the IP header, with no link layer

Definition at line 34 of file pcap.h.

Function Documentation

◆ protocore_pcap_global_header()

void protocore_pcap_global_header ( uint8_t * work )

◆ protocore_pcap_record_header()

void protocore_pcap_record_header ( uint8_t * work )

Variable Documentation

◆ PcapV

PcapVars PcapV

extern

The operands and the outcome.

Classes

Macros

Functions

Variables