| Wireshark 4.7.3 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
Public Attributes | List of all members
wtap_rec Struct Reference

Represents a single capture record read from or written to a capture file, regardless of record type. More...

`#include <wtap.h>`

## Public Attributes
unsigned | rec_type
uint32_t | presence_flags
unsigned | section_number
nstime_t | ts
int | tsprec
const char * | rec_type_name
union { |
wtap_packet_header packet_header |
wtap_ft_specific_header ft_specific_header |
wtap_syscall_header syscall_header |
wtap_systemd_journal_export_header systemd_journal_export_header |
wtap_custom_block_header custom_block_header |
} | rec_header
| Type-specific record header, interpreted according to rec_type.
wtap_block_t | block
| Block-level metadata associated with this record.
bool | block_was_modified
Buffer | options_buf
| Reusable buffer holding serialized file-type-specific option data for this record.
Buffer | data

## Detailed Description

Represents a single capture record read from or written to a capture file, regardless of record type.

## Member Data Documentation

## ◆ block

wtap_block_t wtap_rec::block

Block-level metadata associated with this record.

Carries structured block information (options, etc.) that may overlap with or eventually supersede rec_header. NULL for record types that do not correspond to a pcapng block or equivalent construct.

## ◆ block_was_modified

bool wtap_rec::block_was_modified

True if any field or option within block has been modified since it was read.

## ◆ custom_block_header

wtap_custom_block_header wtap_rec::custom_block_header

Header for custom block records (REC_TYPE_CUSTOM_BLOCK).

## ◆ data

Buffer wtap_rec::data

Raw bytes of the record payload (e.g. the captured packet data).

## ◆ ft_specific_header

wtap_ft_specific_header wtap_rec::ft_specific_header

Header for file-type-specific event records (REC_TYPE_FT_SPECIFIC_EVENT or REC_TYPE_FT_SPECIFIC_REPORT).

## ◆ options_buf

Buffer wtap_rec::options_buf

Reusable buffer holding serialized file-type-specific option data for this record.

Using a persistent Buffer avoids per-record allocation and deallocation overhead for option payloads.

## ◆ packet_header

wtap_packet_header wtap_rec::packet_header

Header for standard captured network packets (REC_TYPE_PACKET).

## ◆ presence_flags

uint32_t wtap_rec::presence_flags

Bitmask of WTAP_HAS_ flags indicating which optional fields are populated in this record.

## ◆ rec_type

unsigned wtap_rec::rec_type

Record type identifier (e.g. REC_TYPE_PACKET, REC_TYPE_FT_SPECIFIC_EVENT).

## ◆ rec_type_name

const char* wtap_rec::rec_type_name

Human-readable name of this record type, suitable for display and logging.

## ◆ section_number

unsigned wtap_rec::section_number

Zero-based index of the section within the capture file that contains this record.

## ◆ syscall_header

wtap_syscall_header wtap_rec::syscall_header

Header for system call event records (REC_TYPE_SYSCALL).

## ◆ systemd_journal_export_header

wtap_systemd_journal_export_header wtap_rec::systemd_journal_export_header

Header for systemd journal export records (REC_TYPE_SYSTEMD_JOURNAL_EXPORT).

## ◆ ts

nstime_t wtap_rec::ts

Timestamp at which this record was captured.

## ◆ tsprec

int wtap_rec::tsprec

Timestamp precision as a WTAP_TSPREC_ constant (e.g. WTAP_TSPREC_USEC, WTAP_TSPREC_NSEC).

The documentation for this struct was generated from the following file:

- /builds/wireshark/wireshark/wiretap/wtap.h