Related Documents and Resources

BPF+: Exploiting Global Data-flow Optimization in a Generalized Packet Filter Architecture [PDF version]
By Andrew Begel, Steven McCanne, and Susan Graham.
DPF
A paper presented at SIGCOMM '96 on an enhanced version of BPF.
Win32 info
An extract of a message from Guy Harris on state of WinPcap and WinDump.
pktdump.c
An old example of a minimal libpcap client.
How to write a libpcap module
A draft HOWTO by Guy Harris.
Awesome PCAP Tools
A list of various projects related to network traffic research. It currently includes the following groups: Linux commands, traffic capture, traffic analysis/inspection, DNS utilities, file extraction and related projects.
Publicly available PCAP files
This is a list of public packet capture repositories, which are freely available on the Internet. Most of the sites listed below share Full Packet Capture (FPC) files, but some do unfortunately only have truncated frames.

Below you can find a few projects that are related to tcpdump or libpcap in some way. If you think some project should be in this list, please either open a pull request as explained here or subscribe to the mailing list and make your input there. The new entry should include the name of the project, a brief (between 200 and 500 characters) description and a link to the project page.

Related Software (Libraries)

LibNet
Libnet is a collection of routines to help with the construction and handling of network packets. It provides a portable framework for low-level network packet shaping, handling and injection. Libnet features portable packet creation interfaces at the IP layer and link layer, as well as a host of supplementary and complementary functionality. Using libnet, quick and simple packet assembly applications can be whipped up with little effort.
Scapy
Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more. It can easily handle most classical tasks like scanning, tracerouting, probing, unit tests, attacks or network discovery (it can replace hping, 85% of nmap, arpspoof, arp-sk, arping, tcpdump, tethereal, p0f, etc.). It also performs very well at a lot of other specific tasks that most other tools can't handle, like sending invalid frames, injecting your own 802.11 frames, combining techniques (VLAN hopping+ARP cache poisoning, VoIP decoding on WEP encrypted channel, …), etc.
libcrafter
Libcrafter is a high level library for C++ designed to make easier the creation and decoding of network packets. It is able to craft or decode packets of most common network protocols, send them on the wire, capture them and match requests and replies.
PcapPlusPlus
A multiplatform C++ network sniffing, packet parsing and crafting framework. It provides a lightweight, easy-to-use and efficient C++ wrapper for libpcap and WinPcap.
Npcap
Npcap is the Nmap Project's packet capture (and sending) library for Microsoft Windows. Npcap began in 2013 as some improvements to the (now discontinued) WinPcap library, but has been largely rewritten since then with hundreds of releases improving Npcap's speed, portability, security, and efficiency.
SharpPcap
A fully managed, cross platform (Windows, Mac, Linux) .NET library for capturing packets from live and file based devices.
GoPacket
This library provides packet decoding capabilities for Go. It contains many sub-packages with additional functionality, including C bindings to use libpcap/PF_RING/AF_PACKET to read packets off the wire. Originally forked from the gopcap project written by Andreas Krennmair.
pypcapfile
pypcapfile is a pure Python library for handling libpcap savefiles.
libtins
libtins is a high-level, multiplatform C++ network packet sniffing and crafting library. Its main purpose is to provide the C++ developer an easy, efficient, platform and endianness-independent way to create tools which need to send, receive and manipulate network packets.
ruby-pcap
ruby-pcap is a ruby extension to libpcap. This library also includes classes to access TCP/IP header.
Pcap4J
Pcap4J is a Java library for capturing, crafting and sending packets. Pcap4J wraps a native packet capture library (libpcap, WinPcap, or Npcap) via JNA and provides you Java-oriented APIs.

Related Software (File Processing)

TCPslice
TCPslice is a tool for extracting portions of packet trace files generated using tcpdump's -w flag. It can combine multiple trace files, and/or extract portions of one or more traces based on time. TCPslice originally comes from LBL and now is maintained by The Tcpdump Group.
TCPTrace
TCPTrace analyzes the behavior of captured TCP streams, and accepts many trace file formats (including pcap). It provides connection statistics and several types of graphs, including the widely-used time-sequence graphs.
NetDude
netdude (NETwork DUmp data Displayer and Editor). From their webpage, "it is a GUI-based tool that allows you to make detailed changes to packets in tcpdump tracefiles."
Xplot
The program xplot was written in the late 1980s to support the analysis of TCP packet traces.
Multitail
MultiTail now has a colorscheme included for monitoring the tcpdump output. It can also filter, convert timestamps to timestrings and much more.
pcapfix
pcapfix is a repair tool for corrupted pcap and pcapng files. It checks for an intact pcap global header and packet block and repairs it if there are any corrupted bytes. If a header is not present, one is created and added to the beginning of the file. It then tries to find pcap packet headers or packet blocks, and checks and repairs them.
Radare2
A free/libre toolchain for easing several low level tasks like forensics, software reverse engineering, exploiting, debugging… Radare2 can process compiled BPF bytecode.
ipsumdump
The ipsumdump program summarizes TCP/IP dump files into a self-describing ASCII format easily readable by humans and programs. Ipsumdump can read packets from network interfaces, from .pcap files, and from existing ipsumdump files. It will transparently uncompress .pcap or ipsumdump files when necessary. It can randomly sample traffic, filter traffic based on its contents, anonymize IP addresses, and sort packets from multiple dumps by timestamp. Also, it can optionally create a .pcap file containing actual packet data.
netmate
Netmate is a GTK+ program that shows network protocols headers in 32-bit aligned fields, identical as they are represented in Request for Comments (RFCs). It can be used to learn and teach about network protocols and to understand their functionality and collaboration. This tool supports input files in pcap(ng) format as they are created by tcpdump, wireshark or other code based on libpcap.
pcaputils
pcaputils includes the following libpcap-based utilities:
  • pcapip: filters an input pcap file based on a file containing IP addresses
  • pcappick: picks specific frames out of a pcap by number
  • pcapuc: prints unique src IPs, dst IPs, or {src, dst} IP pairs witnessed
  • pcapdump: a dedicated packet capture utility similar to dumpcap, but with additional features
TrimPCAP
TrimPCAP is a free open source tool that reduces the size of capture files in an intelligent way. With reduced storage needs comes longer retention periods. TrimPCAP has been shown to reduce most PCAP datasets by over 90 percent!

Related Software (Intrusion Detection)

Socket Sentry
Socket Sentry is a real-time network traffic monitor for KDE Plasma in the same spirit as tools like iftop and netstat.
snort
Snort is an open source network intrusion prevention and detection system (IDS/IPS) developed by Sourcefire. Combining the benefits of signature, protocol and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide. With millions of downloads and approximately 300,000 registered users, Snort has become the de facto standard for IPS.
Zeek
Zeek (formerly Bro) is an open-source, Unix-based Network Intrusion Detection System (NIDS) that passively monitors network traffic and looks for suspicious activity. Zeek detects intrusions by first parsing network traffic to extract its application-level semantics and then executing event-oriented analyzers that compare the activity with patterns deemed troublesome. Its analysis includes detection of specific attacks (including those defined by signatures, but also those defined in terms of events) and unusual activities (e.g., certain hosts connecting to certain services, or patterns of failed connection attempts).
Suricata
Suricata is a high performance Network IDS, IPS and Network Security Monitoring engine.
ArpON
ArpON (ARP handler inspection) is a host-based solution that makes the ARP standardized protocol secure in order to avoid man-in-the-middle (MITM) attacks through ARP spoofing, ARP cache poisoning or ARP poison routing.

Related Software (Packet Capture and Analysis)

EtherApe
EtherApe is a graphical network monitor for Unix modeled after etherman. Featuring link layer, ip and TCP modes, it displays network activity graphically. Hosts and links change in size with traffic. Color coded protocols display. It supports Ethernet, FDDI, Token Ring, ISDN, PPP and SLIP devices. It can filter traffic to be shown, and can read traffic from a file as well as live from the network.
tcpflow
tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis.
Network Top
ntop is a network traffic probe that shows the network usage, similar to what the popular top Unix command does. ntop is based on libpcap and it has been written in a portable way in order to virtually run on every Unix platform and on Win32 as well.
Wireshark
A free network protocol analyzer for Unix and Windows. It allows you to examine data from a live network or from a capture file on disk. You can interactively browse the capture data, viewing summary and detail information for each packet. Wireshark has several powerful features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session.
CoralReef
CoralReef is a software suite developed by CAIDA to analyze data collected by passive Internet traffic monitors. It provides a programming library libcoral, similar to libpcap with extensions for ATM and other network types, which is available from both C and Perl. The software presently supports dedicated PC boxes using OC3mon and OC12mon cards that collect traffic data in real time, as well as reading from pcap tracefiles. Version 3.4 to be released soon supports listening via bpf enabled devices. CoralReef includes drivers, analysis, web report generation, examples, and capture software. This package is maintained by CAIDA developers with the support and collaboration of the Internet measurement community.
TCPstat
tcpstat reports certain network interface statistics much like vmstat does for system statistics. tcpstat gets its information by either monitoring a specific interface, or by reading previously saved tcpdump data from a file.
httpflow
Packet capture and analysis utility similar to tcpdump for HTTP.
ssldump
ssldump is an SSLv3/TLS network protocol analyzer. It identifies TCP connections on the chosen network interface and attempts to interpret them as SSLv3/TLS traffic. When it identifies SSLv3/TLS traffic, it decodes the records and displays them in a textual form to stdout. If provided with the appropriate keying material, it will also decrypt the connections and display the application data traffic. It also includes a JSON output option, supports JA3 and IPv6.
iftop
iftop does for network usage what top(1) does for CPU usage. It listens to network traffic on a named interface and displays a table of current bandwidth usage by pairs of hosts. Handy for answering the question "why is our ADSL link so slow?".
capstats by Bert Vermeulen
Capstats generates byte and packet counters based on a Berkeley Packet Filter (BPF) expression. The basic model is that you run capstats as a daemon (as root), and it will then take commands from a client. Using a client, you can create new capture sessions, modify them, pull up stats on running sessions, and so on.
capstats by Zeek Project
capstats is a small tool to collect statistics on the current load of a network interface, using either libpcap or the native interface for Endace hardware. It reports statistics per time interval and/or for the tool's total run-time.
pmacct
pmacct is a small set of multi-purpose passive network monitoring tools. It can account, classify, aggregate, replicate and export forwarding-plane data, i.e. IPv4 and IPv6 traffic; collect and correlate control-plane data via BGP and BMP; collect and correlate RPKI data; collect infrastructure data via Streaming Telemetry. Each component works both as a standalone daemon and as a thread of execution for correlation purposes (i.e. enrich NetFlow with BGP data).
ngrep
ngrep is like GNU grep applied to the network layer. It's a PCAP-based tool that allows you to specify an extended regular or hexadecimal expression to match against data payloads of packets. It understands many kinds of protocols, including IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw, across a wide variety of interface types, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.
VoIPmonitor
VoIPmonitor is an open source network packet sniffer with commercial frontend for SIP, RTP, RTCP, SKINNY (SCCP), MGCP and WebRTC VoIP protocols running on Linux. VoIPmonitor is designed to analyze quality of VoIP calls based on network parameters—delay variation and packet loss according to ITU-T G.107 E-model, which predicts quality on MOS scale. Calls with all relevant statistics are saved to a MySQL database. Optionally each call can be saved to a .pcap file with either only SIP protocol or SIP/RTP/RTCP/T.38/udptl protocols.

Related Software (Various)

tcpreplay
Tcpreplay is a suite of free Open Source utilities for editing and replaying previously captured network traffic. Originally designed to replay malicious traffic patterns to Intrusion Detection/Prevention Systems, it has seen many evolutions including capabilities to replay to web servers. Tcpreplay includes tcpcapinfo, a tool for decoding the structure of a pcap file with a focus on finding broken pcap files and determining how two related pcap files might differ.
netsniff-ng
netsniff-ng is a free Linux networking toolkit, a Swiss army knife for your daily Linux network plumbing if you will. Its gain of performance is reached by zero-copy mechanisms, so that on packet reception and transmission the kernel does not need to copy packets from kernel space to user space and vice versa.
Termshark
A terminal UI for tshark, inspired by Wireshark.
SIPp
SIPp is a performance testing tool for the SIP protocol. There is a limited support of media plane (RTP). The "PCAP play" feature makes use of libpcap to replay pre-recorded RTP streams towards a destination. RTP streams can be recorded by tools like Wireshark or tcpdump.
knock: a port-knocking implementation
This is a port-knocking server/client. Port-knocking is a method where a server can sniff one of its interfaces for a special "knock" sequence of port-hits. When detected, it will run a specified event bound to that port knock sequence. These port-hits need not be on open ports, since it uses libpcap to sniff the raw interface traffic.
Ettercap
Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis.
NPF
NPF is a layer 3 packet filter, supporting stateful packet inspection, IPv6, NAT, IP sets, extensions and many more. It uses BPF as its core engine and it was designed with a focus on high performance, scalability, multi-threading and modularity. NPF was written from scratch in 2009. It is written in C99 and distributed under the 2-clause BSD license.
arping
Arping is a util to find out if a specific IP address on the LAN is 'taken' and what MAC address owns it.
Ostinato
Ostinato is a versatile packet crafter, pcap editor/player and traffic generator with an intuitive GUI. Add-ons include high-speed 10/25/40G traffic generation and scripting/automation Python APIs. Works on all platforms: Windows, macOS, Linux and the labbing platforms (CML, EVE-NG and GNS3).
arp-scan
arp-scan is a command-line tool for system discovery and fingerprinting. It constructs and sends ARP requests to the specified IP addresses, and displays any responses that are received. arp-scan allows you to:
  • Send ARP packets to any number of destination hosts, using a configurable output bandwidth or packet rate.
  • Construct the outgoing ARP packet in a flexible way.
  • Decode and display any returned packets.
  • Fingerprint IP hosts using the arp-fingerprint tool.
Nmap
Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics.
Caper
Caper is a freely-available, open-source tool for processing packet filters. Filters are used as the first processing stage when capturing, diverting, or dropping network traffic. Caper processes filters by converting them among different representations to clarify their meaning.