Bounded synchronous PCAPNG event sources with exact timestamp metadata.
Own sources with with-open. Reduce each source once; there is no sequence, producer thread, implicit reopen, BPF filter or live capture.
Bounded synchronous PCAPNG event sources with exact timestamp metadata. Own sources with with-open. Reduce each source once; there is no sequence, producer thread, implicit reopen, BPF filter or live capture.
(open-source opts)Open a single-use Closeable IReduceInit source from {:path file-or-path}.
Reads only the first bounded Section Header Block before returning. Reduction emits ordered :section, :interface, :packet and :opaque-block event maps and closes on EOF, reduced, consumer exception or parse/I/O failure. External close cancels further delivery; an already claimed consumer call may finish.
Optional positive ceilings: :max-block-bytes (16 MiB), :max-packet-bytes (8 MiB), :max-options-bytes (1 MiB), :max-options-per-block (4096), :max-interfaces-per-section (4096), :max-section-metadata-bytes (8 MiB), :max-opaque-block-bytes (1 MiB). No unlimited/nil setting. Unknown options fail before opening. See docs/pcapng.md for event, timestamp and failure contracts.
Open a single-use Closeable IReduceInit source from {:path file-or-path}.
Reads only the first bounded Section Header Block before returning. Reduction
emits ordered :section, :interface, :packet and :opaque-block event maps and
closes on EOF, reduced, consumer exception or parse/I/O failure. External close
cancels further delivery; an already claimed consumer call may finish.
Optional positive ceilings: :max-block-bytes (16 MiB), :max-packet-bytes
(8 MiB), :max-options-bytes (1 MiB), :max-options-per-block (4096),
:max-interfaces-per-section (4096), :max-section-metadata-bytes (8 MiB),
:max-opaque-block-bytes (1 MiB). No unlimited/nil setting. Unknown options fail
before opening. See docs/pcapng.md for event, timestamp and failure contracts.(source-info source)Return a bounded data-only source snapshot, without packet/descriptor arrays.
:state is :open/:reading/:closed/:failed; terminal is nil or :eof/:reduced/:closed/:error. Counts include delivered :events/:packets/ :opaque-blocks and validated :blocks-read/:bytes-read. Active interface and metadata accounting become zero after cleanup. :error contains bounded data. A valid prefix or terminal :reduced does not validate the unread suffix.
Return a bounded data-only source snapshot, without packet/descriptor arrays. :state is :open/:reading/:closed/:failed; terminal is nil or :eof/:reduced/:closed/:error. Counts include delivered :events/:packets/ :opaque-blocks and validated :blocks-read/:bytes-read. Active interface and metadata accounting become zero after cleanup. :error contains bounded data. A valid prefix or terminal :reduced does not validate the unread suffix.
(write-pcapng! events path)(write-pcapng! events path opts)Synchronously write ordered PCAPNG events to a new path, once.
(write-pcapng! events path) defaults to :mode :preserve. Options accept :mode :preserve/:lossy/:author, :drop #{:comments :unknown-options :noncopyable-options :custom-options :opaque-blocks} (lossy only), :context-changed? boolean, and the same positive resource ceilings as open-source.
Exact ticks and descriptor options must agree with derived fields. Author mode alone permits exact integral conversion from a complete microsecond pair when :timestamp is absent. Explicit nil is timestamp absence (SPB only). Declare edits/subsets with :context-changed? true; opaque content then needs explicit drops. No inference of source fidelity or detection of hidden edits.
Publishes a closed sibling temporary file with an exclusive atomic rename on Linux/macOS; existing paths and unsupported providers fail without fallback. Returns bounded status/fidelity/loss counts. Failure preserves the exception and adds output location/cleanup details as suppressed exceptions. Paclo sources own their close during reduction; other reducibles own upstream I/O. See docs/pcapng.md for the full policy and ownership contract.
Synchronously write ordered PCAPNG events to a new path, once.
(write-pcapng! events path) defaults to :mode :preserve. Options accept
:mode :preserve/:lossy/:author, :drop #{:comments :unknown-options
:noncopyable-options :custom-options :opaque-blocks} (lossy only), :context-changed? boolean,
and the same positive resource ceilings as open-source.
Exact ticks and descriptor options must agree with derived fields. Author
mode alone permits exact integral conversion from a complete microsecond pair
when :timestamp is absent. Explicit nil is timestamp absence (SPB only).
Declare edits/subsets with :context-changed? true; opaque content then needs
explicit drops. No inference of source fidelity or detection of hidden edits.
Publishes a closed sibling temporary file with an exclusive atomic rename on
Linux/macOS; existing paths and unsupported providers fail without fallback.
Returns bounded status/fidelity/loss counts. Failure preserves the exception
and adds output location/cleanup details as suppressed exceptions. Paclo
sources own their close during reduction; other reducibles own upstream I/O.
See docs/pcapng.md for the full policy and ownership contract.cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |