dfx::Pcapng::Worker Class Reference

Background capture worker responsible for PCAPNG serialization and sink I/O. More...

#include <dfx-pcapng/Worker.hpp>

Classes
struct	QueueData
	One capture item describing a message event and its context. More...
struct	SinkData
	Sink storage and "new sink" marker for hot swapping. More...

Public Types
enum	SinkIndex : std::size_t { File , Pipe , Tcp , Count }
	Index of supported sinks. More...

Public Member Functions
	Worker (bool getHwAndOsInfo)
	Construct and start the worker thread.
	~Worker ()
	Stop the worker thread and release all resources. Ensures the thread is terminated and the poller/timers are destroyed in a safe order.
void	setFileSink (SinkPtr fileSink)
	Install or replace the file sink.
void	setPipeSink (SinkPtr pipeSink)
	Install or replace the pipe sink.
void	setTcpSink (SinkPtr tcpSink)
	Install or replace the TCP sink.
void	pushData (QueueData data)
	Push a capture item into the worker queue.
void	setUserAppInfo (std::string info)
	Set application-specific information to embed into capture metadata.
void	clearHwAndOsInfo () noexcept
	Disable (or remove) hardware/OS metadata in the capture output. This only affects metadata emission; it does not stop the worker.

Detailed Description

Background capture worker responsible for PCAPNG serialization and sink I/O.

Worker is the internal engine behind PCAPNG capture. It decouples hook callbacks (which may be invoked from runtime threads) from:

• PCAPNG encoding,
• sink management (file/pipe/TCP),
• output writes.

The worker owns a dedicated thread and an internal epoll-based poller. Producers push capture items via pushData(), and the worker thread drains and serializes them.

Threading model

• pushData() and sink setters are designed to be called from arbitrary threads.
• The worker thread performs all heavy processing and writes to sinks.
• Communication to the worker thread is done via an event FD (FdWatch::PollerFd) registered in the worker poller.

Sinks and hot swapping

The worker supports up to three sinks simultaneously:

• File, Pipe, TCP (see SinkIndex).

Capture item aggregation / pending data

Capture events are passed as QueueData and include:

• message payload (Core::MessagePtr),
• node/port identity (name + numeric id),
• port mode (input/output),
• a UUID and counters used for internal tracking.

The worker maintains a map of "pending" items keyed by UUID. This enables deferred completion/cleanup behaviors (for example correlating parts of an event stream, or expiring items that did not complete in time).

Metadata emission

The worker can embed optional metadata in the capture output:

• user application info (set via setUserAppInfo()),
• hardware and OS information (enabled by constructor flag, and can be cleared via clearHwAndOsInfo()).

Note

Ordering is preserved according to the queue order as drained by the worker thread. The design goal is to keep hook-side work minimal and move serialization + I/O away from runtime execution threads.

Member Enumeration Documentation

SinkIndex

enum dfx::Pcapng::Worker::SinkIndex : std::size_t

Index of supported sinks.

A worker can write to several sinks at once. Each sink is optional.

Enumerator
File	File output (offline capture). See FileSink.
Pipe	Pipe output (live capture into another process). See PipeSink.
Tcp	TCP output (stream capture to a remote consumer). See TcpSink.
Count	Number of sink slots.

Constructor & Destructor Documentation

Worker()

dfx::Pcapng::Worker::Worker

(

bool

getHwAndOsInfo

)

Construct and start the worker thread.

Parameters

getHwAndOsInfo

If true, hardware/OS information is collected and may be embedded in the capture output.

~Worker()

dfx::Pcapng::Worker::~Worker

(

)

Stop the worker thread and release all resources. Ensures the thread is terminated and the poller/timers are destroyed in a safe order.

Member Function Documentation

clearHwAndOsInfo()

void dfx::Pcapng::Worker::clearHwAndOsInfo ( )

noexcept

Disable (or remove) hardware/OS metadata in the capture output. This only affects metadata emission; it does not stop the worker.

pushData()

void dfx::Pcapng::Worker::pushData

(

QueueData

data

)

Push a capture item into the worker queue.

Thread-safe producer API. Enqueues data and signals the worker so it can drain the queue promptly.

Parameters

data	Capture item to enqueue.

setFileSink()

void dfx::Pcapng::Worker::setFileSink

(

SinkPtr

fileSink

)

Install or replace the file sink.

Safe to call from any thread. The worker will detect the new sink and handle transition/initialization in its thread context.

Parameters

fileSink

New sink instance (may be null to disable).

See also

FileSink

setPipeSink()

void dfx::Pcapng::Worker::setPipeSink

(

SinkPtr

pipeSink

)

Install or replace the pipe sink.

Safe to call from any thread. The worker will detect the new sink and handle transition/initialization in its thread context.

Parameters

pipeSink

New sink instance (may be null to disable).

See also

PipeSink

setTcpSink()

void dfx::Pcapng::Worker::setTcpSink

(

SinkPtr

tcpSink

)

Install or replace the TCP sink.

Safe to call from any thread. The worker will detect the new sink and handle transition/initialization in its thread context.

Parameters

tcpSink

New sink instance (may be null to disable).

See also

TcpSink

setUserAppInfo()

void dfx::Pcapng::Worker::setUserAppInfo

(

std::string

info

)

Set application-specific information to embed into capture metadata.

Parameters

info	Free-form string (scenario name, build id, test name, etc.).

---

The documentation for this class was generated from the following file:

• lib/dfx-pcapng/Worker.hpp