Struct block_t

Inheritance Relationships

Derived Types

Struct Documentation

struct libnokogiri::pcapng::block_t

Base for all pcapng blocks.

This structure represents the atomic base for all blocks defined by libnokogiri as well as by the developer if they add custom blocks.

For documentation on how to add new blocks to libnokogiri see the Adding Blocks section in Extending libnokogiri

Block have the following overarching structure

 0               1               2               3
 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                          Block Type                           |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                       Total Block Size                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/                          Block Data                           /
/                Variable Length padded to 32 bits              /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                       Total Block Size                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

  • Block Type is a 32-bit unsigned value that indicates the type of block.

  • Total Block Size is a 32-bit unsigned value that indicates the size of the block

  • Block Data is the actual data for the block, its length is Total Block Size - 12

The reason for the trailing Total Block Size field is to allow for bidirectional seeking in the pcap file.

All blocks share this format.

NOTE:** The most significant bit (MSB) of the Block Type field indicates if the block if reserved for local use. An MSB of 0b1 indicates that it is a local block, where as an MSB of 0b0 indicates that the type is standard.

Subclassed by libnokogiri::pcapng::blocks::interface_description_t, libnokogiri::pcapng::blocks::section_header_t

Public Functions

constexpr block_t() noexcept
block_type_t type() const noexcept

Gets the type of the block

Protected Functions

constexpr block_t(block_type_t type) noexcept