https://github.com/quackscience/duckdb-extension-pcap
DuckDB PCAP Reader Extension made in Rust
https://github.com/quackscience/duckdb-extension-pcap
duckdb duckdb-extension extension pcap rust
Last synced: 11 months ago
JSON representation
DuckDB PCAP Reader Extension made in Rust
- Host: GitHub
- URL: https://github.com/quackscience/duckdb-extension-pcap
- Owner: quackscience
- Created: 2024-12-06T17:49:52.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2025-02-26T01:02:09.000Z (about 1 year ago)
- Last Synced: 2025-04-15T06:05:41.924Z (11 months ago)
- Topics: duckdb, duckdb-extension, extension, pcap, rust
- Language: Rust
- Homepage: https://duckdb.org/community_extensions/extensions/pcap_reader.html
- Size: 81.1 KB
- Stars: 9
- Watchers: 1
- Forks: 2
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README

# DuckDB PCAP Community Extension
This experimental rust extension allows reading PCAP files from DuckDB using the [pcap-parser crate](https://crates.io/crates/pcap-parser)
> Experimental: USE AT YOUR OWN RISK!
### š¦ Installation
```sql
INSTALL pcap_reader FROM community;
LOAD pcap_reader;
```
### Example
```sql
D SELECT * FROM pcap_reader('test/test.pcap') LIMIT 3;
āāāāāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāā¬āāāāāāāāāāā¬āāāāāāāāāāā¬āāāāāāāāāāā¬āāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā timestamp ā src_ip ā dst_ip ā src_port ā dst_port ā protocol ā length ā payload ā
ā timestamp ā varchar ā varchar ā int32 ā int32 ā varchar ā int32 ā varchar ā
āāāāāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¼āāāāāāāāāāā¼āāāāāāāāāāā¼āāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā 2024-12-06 19:30:2⦠ā xx.xx.xx.xxx ā yyy.yyy.yy.yyy ā 64078 ā 5080 ā UDP ā 756 ā INVITE sip:810442837619024@yyy.yyy.yy.y⦠ā
ā 2024-12-06 19:30:2⦠ā yyy.yyy.yy.yyy ā xx.xx.xx.xxx ā 5080 ā 64078 ā UDP ā 360 ā SIP/2.0 100 Trying\r\nVia: SIP/2.0/UDP ⦠ā
ā 2024-12-06 19:30:2⦠ā yyy.yyy.yy.yyy ā xx.xx.xx.xxx ā 5080 ā 64078 ā UDP ā 909 ā SIP/2.0 480 Temporarily Unavailable\r\n⦠ā
āāāāāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāā“āāāāāāāāāāā“āāāāāāāāāāā“āāāāāāāāāāā“āāāāāāāāā“āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā 3 rows 8 columns ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
```