# pcap-file-ra

This crate provides random access to packets in a pcap file.
You can `get()` n'th packet of pcap in a constant time.

The crate is consider to be a companion crate of the  `pcap-file`.

## Usage

Add to Cargo.toml:
```
[dependency]
pcap-file = "0.10.0"
pcap-file-ra = "0.1.1" 
```

Tested with pcap-file 0.10.0 on windows 64-bit platform.

## Features

- PcapReader wrapper that extracts offsets from pcap file
- Save offset file to speed-up future access.

## Features not planned

- implement `Index` trait for PcapReader
  - `Index` trait can't be implemented because it assumes the returned value is already on some memory location.

## Comparison matrix of existing crates
We depend on `pcap-file`.
The crate was chosen based on the following criteria.

- pcap 0.7.0 - wrapper of pcap/WinPcap
  - support other than little endian: yes
  - support nanosecond pcap: unknown

- **pcap-file** 0.7.0 - manually written pcap parser
  - support other than little endian: yes
  - support nanosecond pcap: yes
  - support write: yes
  - can access to underlying reader: yes

- pcap-rs 1.0.1 - nom-based pcap parser
  - support other than little endian: yes
  - support nanosecond pcap: yes
  - support write: no

- rpcap 0.3.0 - bytepack-based pcap parser
  - support other than little endian: yes
  - support nanosecond pcap: yes
  - support write: yes
  - can access to underlying reader: no

- pcapng 1.0.0 - nom-based pcapng-only parser
  - support other than little endian: no
    - https://github.com/richo/pcapng-rs/issues/1
  - support nanosecond pcap: no
  - support pcap file: no