Use file content heuristics to decide file reader.

.pre-commit-config.yaml

@@ -1,4 +1,4 @@
-exclude: '.*\.(pcap|pcapng|dat)|(PacketExamples|PcapExamples|expected_output|pcap_examples).*\.txt'
+exclude: '.*\.(pcap|pcapng|dat)|(PacketExamples|PcapExamples|expected_output|pcap_examples).*\.(txt|zst|zstd)'
 fail_fast: false
 repos:
   - repo: local
@@ -37,6 +37,7 @@ repos:
         files: ^(Common\+\+|Packet\+\+|Pcap\+\+|Tests|Examples)/.*\.(cpp|h)$
       - id: cppcheck
         args: ["--std=c++14", "--language=c++", "--suppressions-list=cppcheckSuppressions.txt", "--inline-suppr", "--force"]
+        exclude: ^3rdParty/json
   - repo: https://github.com/BlankSpruce/gersemi
     rev: 0.22.3
     hooks:

Pcap++/CMakeLists.txt

@@ -102,6 +102,7 @@ target_link_libraries(
 )
 
 if(LIGHT_PCAPNG_ZSTD)
+  target_compile_definitions(Pcap++ PRIVATE -DPCPP_PCAPNG_ZSTD_SUPPORT)
   target_link_libraries(Pcap++ PRIVATE light_pcapng)
 endif()
 

Pcap++/header/PcapFileDevice.h

@@ -19,6 +19,36 @@ namespace pcpp
 		/// @struct LightPcapNgHandle
 		/// An opaque struct representing a handle for pcapng files.
 		struct LightPcapNgHandle;
+
+		/// @brief An enumeration representing different capture file formats.
+		enum class CaptureFileFormat
+		{
+			Unknown,
+			Pcap,        // regular pcap with microsecond precision
+			PcapNano,    // regular pcap with nanosecond precision
+			PcapNG,      // uncompressed pcapng
+			PcapNGZstd,  // zstd compressed pcapng
+			Snoop,       // solaris snoop
+		};
+
+		/// @brief Heuristic file format detector that scans the magic number of the file format header.
+		class CaptureFileFormatDetector
+		{
+		public:
+			/// @brief Checks a content stream for the magic number and determines the type.
+			/// @param content A content stream that contains the file content.
+			/// @return A CaptureFileFormat value with the detected content type.
+			CaptureFileFormat detectFormat(std::istream& content) const;
+
+		private:
+			CaptureFileFormat detectPcapFile(std::istream& content) const;
+
+			bool isPcapNgFile(std::istream& content) const;
+
+			bool isSnoopFile(std::istream& content) const;
+
+			bool isZstdArchive(std::istream& content) const;
+		};
 	}  // namespace internal
 
 	/// @enum FileTimestampPrecision
@@ -124,7 +154,29 @@ namespace pcpp
 		/// it returns an instance of PcapFileReaderDevice
 		/// @param[in] fileName The file name to open
 		/// @return An instance of the reader to read the file. Notice you should free this instance when done using it
+		/// @deprecated Prefer `createReader` or `tryCreateReader` due to selection of reader based on file content
+		/// instead of extension.
+		PCPP_DEPRECATED("Prefer `tryCreateReader` due to selection of reader based on file content.")
 		static IFileReaderDevice* getReader(const std::string& fileName);
+
+		/// @brief Creates an instance of the reader best fit to read the file.
+		///
+		/// The factory function uses heuristics based on the file content to decide the reader.
+		/// If the file type is known at compile time, it is better to construct a concrete reader instance directly.
+		///
+		/// @param[in] fileName The path to the file to open.
+		/// @return A unique pointer to a reader instance
+		/// @throws std::runtime_error If the file could not be opened or unsupported.
+		static std::unique_ptr<IFileReaderDevice> createReader(const std::string& fileName);
+
+		/// @brief Tries to create an instance of the reader best fit to read the file.
+		///
+		/// The factory function uses heuristics based on the file content to decide the reader.
+		/// If the file type is known at compile time, it is better to construct a concrete reader instance directly.
+		///
+		/// @param fileName The path to the file to open.
+		/// @return A unique pointer to a reader instance, or nullptr if the file could not be opened or unsupported.
+		static std::unique_ptr<IFileReaderDevice> tryCreateReader(const std::string& fileName);
 	};
 
 	/// @class IFileWriterDevice
@@ -313,6 +365,10 @@ namespace pcpp
 		PcapNgFileReaderDevice& operator=(const PcapNgFileReaderDevice& other);
 
 	public:
+		/// @brief A static method that checks if the device was built with zstd compression support
+		/// @return True if zstd compression is supported, false otherwise.
+		static bool isZstdSupported();
+
 		/// A constructor for this class that gets the pcap-ng full path file name to open. Notice that after calling
 		/// this constructor the file isn't opened yet, so reading packets will fail. For opening the file call open()
 		/// @param[in] fileName The full path of the file to read
@@ -397,6 +453,10 @@ namespace pcpp
 		PcapNgFileWriterDevice& operator=(const PcapNgFileWriterDevice& other);
 
 	public:
+		/// @brief A static method that checks if the device was built with zstd compression support.
+		/// @return True if zstd compression is supported, false otherwise.
+		static bool isZstdSupported();
+
 		/// A constructor for this class that gets the pcap-ng full path file name to open for writing or create. Notice
 		/// that after calling this constructor the file isn't opened yet, so writing packets will fail. For opening the
 		/// file call open()