ddn.lib.pcap.filter

BPF filtering support for libpcap.

This module provides the Filter RAII wrapper for bpf_program and functions to compile and apply filters.

Dejan Lekić

BSD-3-Clause

struct Filter

Types 1

RAII wrapper for libpcap's bpf_program.

This structure manages the lifecycle of a compiled BPF program, ensuring that pcap_freecode is called when the filter is no longer needed.

Fields

private bpf_program _program

private bool _compiled

Methods

void free()Frees the compiled BPF program. It is safe to call this method multiple times.

bpf_program * program() return @safe pure nothrow @nogcReturns a pointer to the underlying `bpf_program`.

bool isCompiled() const @safe pure nothrow @nogcChecks if the filter is compiled.

PcapStatus compile(PcapHandle *  handle,  string filterStr,  bool  optimize =  true,  uint  netmask =  PCAP_NETMASK_UNKNOWN)

Compiles a BPF filter string.

bool matches(const(pcap_pkthdr) * header, const(ubyte) * data) constChecks if a packet matches this filter.

PcapStatus compileNoPcap(int  snaplen,  int  linktype,  string filterStr,  bool  optimize =  true,  uint  netmask =  PCAP_NETMASK_UNKNOWN)

Compiles a BPF filter string without requiring an open pcap handle.

Destructors

~thisDestructor frees the compiled BPF program.

fnPcapStatus setFilter(PcapHandle * handle, Filter * filter)Sets the filter for a pcap handle.