https://github.com/quackscience/duckdb-extension-pcap

DuckDB PCAP Reader Extension made in Rust
https://github.com/quackscience/duckdb-extension-pcap

duckdb duckdb-extension extension pcap rust

Last synced: 11 months ago
JSON representation

DuckDB PCAP Reader Extension made in Rust

• Host: GitHub
• URL: https://github.com/quackscience/duckdb-extension-pcap
• Owner: quackscience
• Created: 2024-12-06T17:49:52.000Z (over 1 year ago)
• Default Branch: main
• Last Pushed: 2025-02-26T01:02:09.000Z (about 1 year ago)
• Last Synced: 2025-04-15T06:05:41.924Z (11 months ago)
• Topics: duckdb, duckdb-extension, extension, pcap, rust
• Language: Rust
• Homepage: https://duckdb.org/community_extensions/extensions/pcap_reader.html
• Size: 81.1 KB
• Stars: 9
• Watchers: 1
• Forks: 2
• Open Issues: 2
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

          


# DuckDB PCAP Community Extension 

This experimental rust extension allows reading PCAP files from DuckDB using the [pcap-parser crate](https://crates.io/crates/pcap-parser)

> Experimental: USE AT YOUR OWN RISK!

### 📦 Installation

```sql

INSTALL pcap_reader FROM community;

LOAD pcap_reader;

```

### Example

```sql

D SELECT * FROM pcap_reader('test/test.pcap') LIMIT 3;

┌─────────────────────┬────────────────┬────────────────┬──────────┬──────────┬──────────┬────────┬───────────────────────────────────────────┐

│      timestamp      │     src_ip     │     dst_ip     │ src_port │ dst_port │ protocol │ length │                 payload                   │

│      timestamp      │    varchar     │    varchar     │ int32    │ int32    │ varchar  │ int32  │                 varchar                   │

├─────────────────────┼────────────────┼────────────────┼──────────┼──────────┼──────────┼────────┼───────────────────────────────────────────┤

│ 2024-12-06 19:30:2… │ xx.xx.xx.xxx   │ yyy.yyy.yy.yyy │ 64078    │ 5080     │ UDP      │ 756    │ INVITE sip:810442837619024@yyy.yyy.yy.y…  │

│ 2024-12-06 19:30:2… │ yyy.yyy.yy.yyy │ xx.xx.xx.xxx   │ 5080     │ 64078    │ UDP      │ 360    │ SIP/2.0 100 Trying\r\nVia: SIP/2.0/UDP …  │

│ 2024-12-06 19:30:2… │ yyy.yyy.yy.yyy │ xx.xx.xx.xxx   │ 5080     │ 64078    │ UDP      │ 909    │ SIP/2.0 480 Temporarily Unavailable\r\n…  │

├─────────────────────┴────────────────┴────────────────┴──────────┴──────────┴──────────┴────────┴───────────────────────────────────────────┤

│ 3 rows                                                                                                                            8 columns │

└─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘

```