INNER CODE UNIT · Rust

setup_packet_capture

domcyrus/rustnet · crates/rustnet-capture/src/lib.rs:214

pub fn setup_packet_capture(config: CaptureConfig) -> Result<(Capture<Active>, String, i32)> {
    // Try PKTAP first on macOS for process metadata, but only when:
    // - No interface is explicitly specified
    // - No BPF filter is specified (BPF filters don't work with PKTAP's linktype 149)
    #[cfg(target_os = "macos")]
    if config.interface.is_none() && config.filter.is_none() {
        log::info!("Attempting to use PKTAP for process metadata on macOS");

        match Capture::from_device("pktap") {
            Ok(pktap_builder) => {
                let pktap_cap = pktap_builder
                    .promisc(false) // PKTAP doesn't use promiscuous mode
                    .snaplen(config.snaplen)
                    .buffer_size(config.buffer_size)
                    .timeout(config.timeout_ms)
                    .immediate_mode(true)
                    .want_pktap(true)
                    .open()

View source record →