dfx::Pcapng::Sink Class Reference

Abstract output destination for PCAPNG capture data. More...

#include <dfx-pcapng/sinks/Sink.hpp>

Inheritance diagram for dfx::Pcapng::Sink:

Collaboration diagram for dfx::Pcapng::Sink:

Public Member Functions
	Sink () noexcept=default
	Construct a sink.
	DISABLE_COPY_AND_MOVE (Sink)
	Sinks are not copyable and not movable.
virtual	~Sink ()=default
	Virtual destructor for polymorphic use.
virtual void	init (std::vector< uint8_t > initialHeader)=0
	Initialize the sink and write the initial PCAPNG header.
void	setPoller (FdWatch::Poller *poller)
	Provide a poller that the sink may use for event-driven I/O.
virtual void	write (std::vector< uint8_t > data)=0
	Write serialized PCAPNG bytes to the sink.

Protected Attributes
FdWatch::Poller *	_poller = nullptr
	Borrowed poller pointer for event-driven sink implementations.

Detailed Description

Abstract output destination for PCAPNG capture data.

Sink is the output abstraction used by the PCAPNG capture subsystem. A sink receives already-serialized PCAPNG bytes (produced by the capture writer/worker) and is responsible for delivering them to a destination such as:

• a file (offline capture),
• a pipe (live streaming into Wireshark),
• a TCP connection (remote streaming).

Unlike a simple file-like API, a Sink may optionally integrate with the runtime I/O model through a FdWatch::Poller :

• the worker injects a poller pointer with setPoller(),
• the sink may register its own file descriptors (socket, pipe, timer…) on that poller, and react to readiness events,
• this enables non-blocking / event-driven sinks without embedding a separate event loop.

Lifecycle

The expected sequence is:

1. The sink object is constructed (its poller is always null at this stage).
2. The worker calls setPoller() to provide the poller to use.
3. The worker calls init() exactly once per installation, providing the initial PCAPNG header bytes that must be emitted first in the stream.
4. The worker calls write() repeatedly to append more serialized PCAPNG blocks.

Replacing a sink typically means destroying the old sink and installing a new one, which will receive a fresh init() call with a fresh header.

Threading

Sinks are expected to be driven by the capture worker thread. This interface does not require sinks to be thread-safe.

Note

The poller pointer provided via setPoller() is borrowed. The sink must not delete it, and must assume it can become invalid when the worker shuts down. Implementations should deregister any watched FDs as part of their destruction. dfx::FdWatch::PollerFd

Constructor & Destructor Documentation

Sink()

dfx::Pcapng::Sink::Sink ( )

defaultnoexcept

Construct a sink.

The poller pointer is always null immediately after construction. It is only set later via setPoller().

~Sink()

virtual dfx::Pcapng::Sink::~Sink ( )

virtualdefault

Virtual destructor for polymorphic use.

Member Function Documentation

DISABLE_COPY_AND_MOVE()

dfx::Pcapng::Sink::DISABLE_COPY_AND_MOVE

(

Sink

)

Sinks are not copyable and not movable.

init()

virtual void dfx::Pcapng::Sink::init ( std::vector< uint8_t > initialHeader )

pure virtual

Initialize the sink and write the initial PCAPNG header.

This method is called by the capture worker when the sink becomes active.

Important points:

• This is the first call that provides capture bytes to the sink.
• By the time init() is called, the worker will already have called setPoller() (so _poller will be non-null).
• Implementations should treat this as "start of stream": any internal state needed for writing should be created here.

Parameters

initialHeader

Serialized bytes that must be emitted first in the output stream (typically the Section Header Block and related initial blocks).

Implemented in dfx::Pcapng::FileSink, dfx::Pcapng::PipeSink, and dfx::Pcapng::TcpSink.

setPoller()

void dfx::Pcapng::Sink::setPoller ( FdWatch::Poller * poller )

inline

Provide a poller that the sink may use for event-driven I/O.

Sinks that need non-blocking I/O can use this poller to register their own file descriptors for readiness notification.

Parameters

poller

Poller to use (borrowed).

write()

virtual void dfx::Pcapng::Sink::write ( std::vector< uint8_t > data )

pure virtual

Write serialized PCAPNG bytes to the sink.

Parameters

data	Serialized bytes to append to the capture stream.

Called repeatedly after init().

The sink receives already-formed PCAPNG bytes (blocks or sequences of blocks) and must deliver them to the underlying destination.

Implementations may choose to:

• write synchronously,
• buffer and flush later using the poller,
• drop data on failure (with diagnostics), depending on the sink semantics.

Implemented in dfx::Pcapng::FileSink, dfx::Pcapng::PipeSink, and dfx::Pcapng::TcpSink.

Member Data Documentation

_poller

FdWatch::Poller* dfx::Pcapng::Sink::_poller = nullptr

protected

Borrowed poller pointer for event-driven sink implementations.

Set by setPoller(). The pointer is null by default but will be non-null by the time init() / write() is called.

---

The documentation for this class was generated from the following file:

• lib/dfx-pcapng/sinks/Sink.hpp