NetworkInspector.Sources 0.3.0

NetworkInspector.Sources

Capture reader package for NetworkInspector with random-access and streaming source options.

What This Is

NetworkInspector.Sources opens and reads capture files so you can parse them through Core/Protocols pipelines.

Supported families include:

• PCAP and PCAPNG,
• BLF,
• ASC,
• synthetic and cached sources for testing and benchmarking.

Why It Stands Out

• Covers both random-access and stream-first workflows.
• Supports large-file handling with memory-budget-oriented options.
• Integrates directly into parser and exporter pipelines.

Install

dotnet add package NetworkInspector.Sources
dotnet add package NetworkInspector.Core

Choose The Right Source Type

Quick Start

Open From File

using NetworkInspector.Sources.Pcapng;

PcapSource source = PcapSource.Open("capture.pcapng");
foreach (RawFrame rawFrame in source)
{
    // Parse with Core/Protocols pipeline
}

Open From Stream

using NetworkInspector.Sources.Asc;

AscStreamSource source = AscStreamSource.FromStream(fileStream, "ASC stream");
foreach (RawFrame rawFrame in source)
{
    // Parse with Core/Protocols pipeline
}

Common Tasks

Handle Large ASC Files

Use AscSourceOptions.PreloadBudget to control in-memory vs disk-backed behavior.

Combine With Parser Stack

Read RawFrame instances from sources, then convert them to Frame and parse into Packet via Core.

Use Random Access

Use random-access source variants where frame-id lookups are required for replay, indexing, or test cases.

Limits And Thread-Safety Notes

• Choose streaming sources for very large captures to bound memory usage.
• Validate source format and assumptions before automated ingestion.
• Use cancellation and external execution limits in long-running jobs.

Safe Usage (STRIDE)

• Spoofing: Assume file names/extensions may be misleading; validate expected source format before processing.
• Tampering: Handle malformed headers and partial records as expected external-input failure modes.
• Repudiation: Preserve source metadata if downstream workflows require traceability.
• Information disclosure: Treat raw captures as sensitive data and apply access controls.
• Denial of service: Use streaming modes, budgets, and cancellation to guard against oversized inputs.
• Elevation of privilege: Run source readers with least-required filesystem permissions.

Links

• GitHub repository
• NuGet package
• Source folder
• Issue tracker
• SOURCE_GUIDE.md

License

MIT License