Feat/net

.github/workflows/checks.yml

@@ -65,7 +65,7 @@ jobs:
       - name: Install build dependencies
         run: |
           apt-get update
-          apt-get install -y --no-install-recommends clang libclang-dev
+          apt-get install -y --no-install-recommends clang libclang-dev libpcap-dev
       - name: Cache Cargo registry and git
         uses: actions/cache@v4
         with:

.github/workflows/test.yml

@@ -286,6 +286,39 @@ jobs:
       - name: Run WebSocket tests
         run: |
           cargo test --features=websocket extension_cases::websocket
+  test-net:
+    name: Extension / Net
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        arch: [amd64]
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          submodules: true
+      - name: Cache Cargo registry and git
+        uses: actions/cache@v4
+        with:
+          path: /home/runner/.cargo
+          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+      - name: Cache Rust target directory
+        uses: actions/cache@v4
+        with:
+          path: target
+          key: target-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-${{ hashFiles('**/Cargo.toml') }}
+          restore-keys: |
+            target-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-
+            target-${{ runner.os }}-
+      - name: Setup Rust Toolchain
+        uses: ./.github/actions/setup-rust
+      - name: Install libpcap
+        run: sudo apt-get update && sudo apt-get install -y libpcap-dev
+      - name: Run Net tests
+        run: |
+          cargo test --manifest-path crates/datafusion-net/Cargo.toml --all-features
+          cargo test --features=net extension_cases::net
   test-clickhouse:
     name: Extension / ClickHouse
     runs-on: ubuntu-latest
@@ -526,6 +559,8 @@ jobs:
             target-${{ runner.os }}-
       - name: Setup Rust Toolchain
         uses: ./.github/actions/setup-rust
+      - name: Install libpcap
+        run: sudo apt-get update && sudo apt-get install -y libpcap-dev
       - name: Run UDFs WASM tests
         run: |
           cargo test --all-features --manifest-path crates/datafusion-app/Cargo.toml

CLAUDE.md

@@ -110,11 +110,13 @@ cargo test --features="deltalake s3" extension_cases::deltalake::test_deltalake_
 cargo test --features=udfs-wasm extension_cases::udfs_wasm
 cargo test --features=vortex extension_cases::vortex
 cargo test --features=vortex cli_cases::basic::test_output_vortex
+cargo test --features=net extension_cases::net  # Requires libpcap (libpcap-dev on Debian/Ubuntu)
 
 # Run tests for specific crates
 cargo test --manifest-path crates/datafusion-app/Cargo.toml --all-features
 cargo test --manifest-path crates/datafusion-functions-parquet/Cargo.toml
 cargo test --manifest-path crates/datafusion-udfs-wasm/Cargo.toml
+cargo test --manifest-path crates/datafusion-net/Cargo.toml --all-features
 
 # Run a single test
 cargo test <test_name>
@@ -168,6 +170,8 @@ The project is organized as a workspace with multiple crates:
 
 - **`crates/datafusion-udfs-wasm`**: WASM-based UDF support
 
+- **`crates/datafusion-net`**: Network packet capture querying — `pcap` (capture files), `capture` (live capture), `interfaces` (list capture devices), and `tcp_conversations` (per-connection TCP flow analytics) table functions (`capture`/`interfaces` behind its `live` feature); the `reverse_dns` (IP → hostname via PTR lookup) and `geoip` (IP → location via MaxMind `.mmdb` database) scalar UDFs; the `dns_query` and `tls_sni` payload-decoding scalar UDFs; and `pcap_wide` / `capture_wide` variants that append DNS and geolocation enrichment columns
+
 - **`crates/datafusion-auth`**: Authentication implementations
 
 - **`crates/datafusion-ffi-table-providers`**: FFI table provider support
@@ -212,6 +216,7 @@ The project uses extensive feature flags to keep binary size manageable:
 - `flightsql` - FlightSQL server and client
 - `http` - HTTP server
 - `huggingface` - HuggingFace dataset integration
+- `net` - Query network packet captures (pcap files and live capture) via SQL
 - `udfs-wasm` - WASM UDF support
 - `observability` - Metrics and tracing (required by servers)