PcapPlusPlus is a multiplatform C++ network sniffing and packet parsing and manipulation framework. PcapPlusPlus is meant to be lightweight, efficient and easy to use.
What makes PcapPlusPlus different from similar C++ wrappers for libpcap/WinPcap?
- Designed to be lightweight and efficient
- Support for DPDK fast packet processing engine which enables packet capturing and transmition in line rate using kernel bypass
- Support for ntop’s PF_RING packet capturing engine that dramatically improves the packet capture speed
- Support for parsing and editing of many protocols, including L7 protocols like HTTP and SSL/TLS
- Unique implementation of TCP reassembly logic which includes support of TCP retransmission, out-of-order TCP packets and missing TCP data
- Support for Remote Capture capabilities on Windows (using RPCAP protocol supported in WinPcap)
- Support for reading and writing PCAPNG files (a lot more more than currently supported in WinPcap/libpcap)
- Vast object-oriented filtering mechanism that makes libpcap filters a lot more user-friendly (no need to know the exact filter string to use)
PcapPlusPlus is currently supported on Windows, Linux and Mac OS X. It was tested on the following platforms:
- Windows:
- Microsoft Visual Studio 2015 (32-bit + 64-bit compilation)
- MinGW32 (32-bit compilation only)
- MinGW-w64 (32-bit compilation only)
- Linux:
- Ubuntu (12.04 LTS, 14.04 LTS, 16.04 LTS, 14.10)
- Fedora
- CentOS
- It should work on other Linux distributions as well
- Mac OS X:
- Yosemite (10.10)
- El Capitan (10.11)
- Sierra (10.12)
Supported packet capture engines
PcapPlusPlus currently works with the following packet capture engines:
- libpcap live capture (on Linux and Mac OS X)
- WinPcap live capture (on Windows)
- ntop’s Vanilla PF_RING engine (on Linux)
- Intel DPDK engine (on Linux)
- WinPcap Remote live capture (on Windows)
- PCAP and PCAPNG file devices (reading and writing)
Supported protocols
The Packet++ library currently supports parsing, editing and creation of packets of the following protocols:
- Ethernet
- SLL (Linux cooked capture)
- Null/Loopback
- Raw IP (IPv4 & IPv6)
- IPv4
- IPv6
- ARP
- VLAN
- VXLAN
- MPLS
- PPPoE
- GRE
- TCP
- UDP
- ICMP
- IGMP (IGMPv1, IGMPv2 and IGMPv3 are supported)
- DNS
- DHCP
- HTTP headers (request & response)
- SSL/TLS – parsing only (no editing capabilities)
- Generic payload
Packet And Network Utilities
- TCP reassembly logic
- Packet hash key creation (by 5-tuple and 2-tuple)
- Retrieve remote machine MAC address using ARP protocol
- Retrieve host IPv4 address by using DNS protocol
- Checksum calculation
