dfx::Pcapng::Writer Class Reference

Stateless PCAPNG block writer helpers for dfx captures. More...

#include <dfx-pcapng/Writer.hpp>

Classes
struct	Entry
	Captured message event used to generate a packet block. More...
struct	Info
	Minimal endpoint identifier for message routing metadata. More...
struct	NodeInfo
	Minimal node identity used for PCAPNG metadata. More...

Static Public Member Functions
static std::vector< uint8_t >	writeSectionHeaderBlock (std::string_view hardware, std::string_view os, std::string_view userapp)
	Serialize a PCAPNG Section Header Block (SHB).
static std::vector< uint8_t >	writeInterfaceDescriptionBlock (Core::Kind kind)
	Serialize a PCAPNG Interface Description Block (IDB).
static std::vector< uint8_t >	writeEnhancedPacketBlock (Entry const &entry)
	Serialize a PCAPNG Enhanced Packet Block (EPB) for a captured message event.

Detailed Description

Stateless PCAPNG block writer helpers for dfx captures.

Writer is a collection of helper functions used to serialize dfx capture data into PCAPNG binary blocks (Wireshark-readable).

Since dfx is not a network protocol, message transfers do not correspond to real link-layer frames. Instead, a custom encapsulation format is used inside PCAPNG packets.

The Writer encodes dfx message events using the following link-layer types:

• DLT_USER0
• DLT_USER1

These are standard "user-defined" link-layer identifiers provided by PCAPNG. The actual packet payload format is dfx-specific.

Wireshark decoding

To properly decode dfx packets in Wireshark, a custom Lua dissector is provided:

wireshark-dissector/dfx.lua

(located at the root of the repository)

This dissector understands the custom dfx packet layout embedded inside DLT_USER0 / DLT_USER1 frames and renders node/port/message information in a human-readable way.

Without this dissector, Wireshark will only display raw packet bytes.

Design goals

• Keep Writer completely stateless.
• Return fully-formed PCAPNG blocks as std::vector<uint8_t>.
• Allow concatenation of blocks into a valid PCAPNG stream.
• Decouple encoding from I/O (handled by Worker + sinks).

Note

The exact encoding details (block structure, option layout, padding, endianness) are defined by the implementation but are guaranteed to produce valid PCAPNG blocks compatible with Wireshark when used with the provided dissector.

Member Function Documentation

writeEnhancedPacketBlock()

std::vector< uint8_t > dfx::Pcapng::Writer::writeEnhancedPacketBlock ( Entry const & entry )

static

Serialize a PCAPNG Enhanced Packet Block (EPB) for a captured message event.

Encodes a single message transfer as an Enhanced Packet Block. The resulting EPB contains:

• a representation of the message payload, and
• metadata identifying source/destination endpoints (node/port ids), in a form that can be inspected in Wireshark.

Parameters

entry

Captured message event.

Returns

Byte buffer containing a complete EPB.

writeInterfaceDescriptionBlock()

std::vector< uint8_t > dfx::Pcapng::Writer::writeInterfaceDescriptionBlock ( Core::Kind kind )

static

Serialize a PCAPNG Interface Description Block (IDB).

PCAPNG packet blocks reference an interface id. In a dfx capture, the interface concept is used to model message categories/types (represented by Core::Kind).

Callers typically emit one IDB per interface they intend to reference later.

Parameters

kind	Port/message kind used to describe the "interface" type.

Returns

Byte buffer containing a complete IDB.

writeSectionHeaderBlock()

std::vector< uint8_t > dfx::Pcapng::Writer::writeSectionHeaderBlock ( std::string_view hardware, std::string_view os, std::string_view userapp )

static

Serialize a PCAPNG Section Header Block (SHB).

The Section Header Block starts a PCAPNG stream and describes the capture environment. The provided strings are typically encoded as SHB options

Callers usually write exactly one SHB at the beginning of a capture stream.

Parameters

hardware	Hardware description string (may be empty).
os	Operating system description string (may be empty).
userapp	User application/scenario description string (may be empty).

Returns

Byte buffer containing a complete SHB.

---

The documentation for this class was generated from the following file:

• lib/dfx-pcapng/Writer.hpp