NetworkInspector.Core 0.3.0

NetworkInspector.Core

NetworkInspector.Core is the parsing runtime of the NetworkInspector stack.

What This Is

Use this package when you need to turn raw frame bytes into structured packet fields and inspect those fields in .NET code.

Core provides:

• parser stack construction (StackBuilder and Stack),
• frame creation and packet parsing APIs,
• field traversal primitives used by exporters and custom analysis code,
• runtime plumbing used by built-in protocol packages.

Why It Stands Out

• Built for high-throughput parsing workflows.
• Integrates directly with built-in dissectors from NetworkInspector.Protocols.
• Works in both application code and service pipelines.

Install

dotnet add package NetworkInspector.Core
dotnet add package NetworkInspector.Protocols

Quick Start

using NetworkInspector.Core;
using NetworkInspector.Protocols;

StackBuilder builder = new(new SettingsManager(), new FrameInterfaceRegistry());
ProtocolRegistration.RegisterStandardProtocols(builder);
Stack stack = builder.Build();

Frame frame = Frame.Create(
    new FrameId(0),
    Timestamp.FromSecs(0),
    rawBytes,
    LinkType.Ethernet,
    FrameInterfaceId.Invalid,
    stack.FrameInterfaceRegistry).Value;

Packet packet = Packet.ParseFrame(new PacketId(0), stack, frame);
foreach (Field field in packet)
{
    Console.WriteLine($"{field.Info.UiName}: {field.Value}");
}

stack.Dispose();

Post-Parser Pipeline

Post-parsers are protocol-owned callbacks that run after the main protocol dispatch on every packet. Register them during stack construction with RegisterPostParser(protocolId, priority).

Execution order — post-parsers are sorted once at build time: ascending by priority (lower values run first), then ascending by registration order as a stable tie-breaker. No sorting overhead occurs during parsing.

Lifecycle — post-parsers execute after the full protocol dispatch tree, before packet.info is appended, and before the packet is sealed. They receive the packet root field as parent, so their fields appear as root-level siblings identical to top-level protocol fields.

Index and value-cache — in indexed parses (ParseFrameIndexed), post-parsers run before PacketIndex.EndPacket. Their RecordProtocolPresence, RecordGroupPresence, and value-cache writes are treated identically to those of normal parsers.

Error policy — a ParseResult error or exception from any post-parser is recorded as a packet.error and made visible. Remaining post-parsers always continue executing regardless of earlier failures. No errors are silently discarded.

Common Tasks

Register Standard Protocols

Use ProtocolRegistration.RegisterStandardProtocols(builder) to activate the default dissector set.

Parse From Capture Readers

Combine Core with NetworkInspector.Sources readers to parse frames from PCAP/PCAPNG/BLF/ASC sources.

Feed Export Pipelines

Parse packets with Core, then send them to NetworkInspector.Exporters packet exporters (JSON/PBF/CSV/Text).

Practical Notes

• Build stacks once and reuse for batch parsing jobs.
• Dispose stacks explicitly when parsing is complete.
• Keep parser lifecycle and mutable operations in controlled execution scopes.

Limits And Thread-Safety Notes

• Treat stack construction and mutable parse contexts as single-threaded unless package docs state otherwise.
• Validate external frame bytes at system boundaries.
• Use cancellation in surrounding workflow code for long-running ingest loops.

Links

• GitHub repository
• NuGet package
• Source folder
• Issue tracker
• Protocols package
• Sources package
• Exporters package
• Root overview

License

MIT License