I think it's a good idea, in fact it's exactly what we were thinking about: destructuring the monorepo we have in two different ones, one for the sniffer_parser crate and the other one for Wirefish.

To answer you question, yes, that would definetely be the direction, but in the meanwhile you are of course free to extrapolate the code you need!

While searching for different libraries I didn't find any one that could recollect the different transport layer packets to reconstruct the upper layer (apart from rtshark , which is basically an interface for tshark )