Nu plugin to parse pcap file
- Download the latest binary for your platform and extract it to a path in your
$PATH. Alternatively, you can build the plugin from source by cloning this repository and runningcargo install --locked --path .from the root of the repository. - Register the plugin with
plugin add <path-to-plugin>. - Use the plugin with
plugin use format_pcap.
The plugin exposes a single command, from pcap, which takes a single argument: a binary stream of pcap data.
Meaning you can either use the open <file.pcap> directly, or pipe from a dump command like sudo tcpdump -i en0 -w - | from pcap.