Add PCAP / PCAPNG packet-capture parser

crates/ax-normalize/Cargo.toml

@@ -42,11 +42,18 @@ polars = { version = "0.53", default-features = false, features = [
 # JSON-shaped sources. Behind the default-on `evtx` feature, so the text-only
 # `--no-default-features` build stays lean.
 evtx = { version = "0.11", optional = true }
+# PCAP / PCAPNG packet captures. `pcap-parser` decodes the container (both
+# formats) into per-packet timestamp/length/data; `etherparse` decodes the
+# Ethernet/IPv4/transport headers to src/dst/ports. Behind the default-on `pcap`
+# feature, so the text-only build stays lean.
+pcap-parser = { version = "0.17", optional = true }
+etherparse = { version = "0.20", optional = true }
 
 [features]
-default = ["polars", "evtx"]
+default = ["polars", "evtx", "pcap"]
 polars = ["dep:polars"]
 evtx = ["dep:evtx"]
+pcap = ["dep:pcap-parser", "dep:etherparse"]
 
 [dev-dependencies]
 proptest = { workspace = true }

crates/ax-normalize/src/parser.rs

@@ -216,6 +216,8 @@ mod tests {
         }
         #[cfg(feature = "evtx")]
         expected.push("evtx");
+        #[cfg(feature = "pcap")]
+        expected.push("pcap");
         expected.extend([
             "otlp",
             "cloudtrail",

crates/ax-normalize/src/parsers/mod.rs

@@ -18,6 +18,8 @@ pub mod logfmt;
 pub mod ndjson;
 pub mod osquery;
 pub mod otlp;
+#[cfg(feature = "pcap")]
+pub mod pcap;
 pub mod prometheus;
 pub mod syslog;
 pub mod toml;
@@ -41,6 +43,8 @@ pub use logfmt::LogfmtParser;
 pub use ndjson::NdjsonParser;
 pub use osquery::OsqueryParser;
 pub use otlp::OtlpParser;
+#[cfg(feature = "pcap")]
+pub use pcap::PcapParser;
 pub use prometheus::PrometheusParser;
 pub use syslog::SyslogParser;
 pub use toml::{IniParser, TomlParser};
@@ -60,6 +64,8 @@ pub fn default_registry() -> ParserRegistry {
     // other magic-detected binary readers, ahead of the text shapes.
     #[cfg(feature = "evtx")]
     r.register(Box::new(EvtxParser));
+    #[cfg(feature = "pcap")]
+    r.register(Box::new(PcapParser));
     // OTLP before NDJSON: a compact single-object OTLP doc must win the
     // `resourceSpans` signature before any JSON-line heuristic sees it.
     r.register(Box::new(OtlpParser));