DOCSEARCHbyAlgolia
Submit Docs

PcapPlusPlus Documentation

repository·master·Indexed 25 days ago

https://github.com/seladb/pcapplusplus

A multiplatform C++ library for high-performance capturing, parsing, and crafting of network packets. It provides high-level C++ wrappers for packet processing engines including libpcap, DPDK, and AF_XDP. The repository also includes utilities for ARP and DNS resolution and spoofing, a portable C++ hashing library supporting CRC32, MD5, SHA, and Keccak, and MemPlumber, a C++ library for debugging memory allocations and detecting leaks.

Tokens
21.5K
Snippets
48
Records
125
Agent score
82%

What's inside PcapPlusPlus

  1. Overview of PcapPlusPlus features

    master

    PcapPlusPlus is a cross-platform C++ library for capturing, analyzing, and crafting network packets. Key features include:

    • Packet Capture: C++ wrappers for engines like libpcap, WinPcap, Npcap, Intel DPDK, eBPF AF_XDP, WinDivert, and PF_RING.
    • Parsing and Crafting: Detailed decoding and generation for numerous network protocols.
    • File I/O: Reading and writing packets in PCAP and PCAPNG formats.
    • Line-rate Processing: High-performance support via DPDK, eBPF AF_XDP, and PF_RING.
    • Packet Reassembly: Includes TCP Reassembly (handling retransmissions, out-of-order packets, and missing data) and IP Fragmentation/Defragmentation for IPv4 and IPv6.
    • Packet Filtering: User-friendly wrappers for libpcap BPF filters.
    • TLS Fingerprinting: C++ implementation of JA3 and JA3S algorithms.

  2. Overview of PcapPlusPlus libraries

    master

    PcapPlusPlus is composed of three main libraries:

    1. Packet++: Used for analyzing, creating, and editing network packets.
    2. Pcap++: Used for capturing and sending packets, providing network and network interface information, statistics, etc. It acts as a C++ wrapper for capture engines like libpcap, WinPcap, Npcap, DPDK, AF_XDP, WinDivert, and PF_RING.
    3. Common++: Contains common utility functions used by both Packet++ and Pcap++.

  3. Overview of IPDefragUtil

    master
    IPDefragUtil is a utility designed to reassemble IP fragments back into full packets. It supports both IPv4 and IPv6 reassembly and operates on pcap and pcapng files. Users can control which packets are reassembled using specific IP IDs (IPv4), fragment IDs (IPv6), or Berkeley Packet Filter (BPF) syntax.

  4. Overview of SSLAnalyzer output statistics

    master

    The SSLAnalyzer provides a detailed STATS SUMMARY including:

    • General stats: Sample time, packet count/rate, flow count/rate, total SSL data, average packets/data per flow, Client-hello/Server-hello message counts, and handshake success/alert counts.
    • SSL/TLS ports count: A histogram of ports used for SSL/TLS traffic.
    • SSL/TLS versions count: A histogram of detected SSL/TLS versions (e.g., TLS 1.2).
    • Cipher-suite count: A histogram of used cipher suites (e.g., TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256).
    • Server-name count: A histogram of hostnames (SNI) detected in the traffic.

  5. Understand the HTTP Traffic Analyzer stats summary

    master

    The HttpAnalyzer output provides several categories of metrics:

    General stats

    • Sample time: Total duration of analysis.
    • HTTP packets/flows/transactions: Counts and rates for packets, flows, and transactions.
    • HTTP data: Total bytes and data rate.
    • Averages: Packets per flow, transactions per flow, and data per flow.

    HTTP request stats

    • Requests: Count and rate of HTTP requests.
    • Header size: Total data in headers and average header size.

    HTTP response stats

    • Responses: Count and rate of HTTP responses.
    • Header size: Total data in headers and average header size.
    • Body size: Count of responses with content-length, total body size (may be compressed), and average body size.

    Histograms

    • HTTP request methods: Count of methods used (e.g., GET, POST).
    • Hostnames count: Frequency of requests per hostname.
    • Status code count: Distribution of HTTP status codes (e.g., 200 OK, 404 Not Found).
    • Content-type count: Distribution of media types (e.g., application/json, image/jpeg).

  6. PcapPlusPlus Library Components

    master

    PcapPlusPlus is composed of three main libraries:

    1. Packet++: For parsing, generating, and editing network packets.
    2. Pcap++: For intercepting and sending packets, providing network/NIC information, and statistics. It acts as a C++ wrapper for engines like libpcap, WinPcap, Npcap, DPDK, AF_XDP, WinDivert, and PF_RING.
    3. Common++: Contains common code utilities used by both Packet++ and Pcap++.

  8. Understand the PcapPlusPlus library structure

    master

    PcapPlusPlus is composed of three main libraries:

    1. Packet++: Used for parsing, generating, and editing network packets.
    2. Pcap++: Provides C++ wrappers for packet capture engines (such as libpcap, WinPcap, Npcap, DPDK, AF_XDP, WinDivert, and PF_RING) to capture and send packets, and to provide network/NIC information and statistics.
    3. Common++: Contains general code utilities used by both Packet++ and Pcap++.

  9. DPDK and PF_RING Support

    master

    PcapPlusPlus provides a C++ abstraction layer over high-speed packet processing frameworks:

    • DPDK (Data Plane Development Kit): Provides a high-speed data plane and NIC drivers. PcapPlusPlus removes boilerplate to provide an easy-to-use interface for DPDK.
    • PF_RING™: A high-speed packet capture framework. PcapPlusPlus provides an abstraction layer to simplify usage.

    These frameworks are ideal for line-speed packet processing in routers, firewalls, and load balancers.

  10. Hash Library Features and Compatibility

    master

    The Portable C++ Hashing Library is a lightweight, open-source (zlib license) library with the following characteristics:

    • Supported Algorithms: CRC32, MD5, SHA1, SHA256, Keccak, SHA3, and optional HMAC.
    • Dependencies: No external dependencies.
    • Portability: Supports Windows and Linux; tested on both Little Endian and Big Endian CPUs.
    • Performance: Designed to be roughly as fast as Linux core hashing functions.

  11. Use the TLSFingerprinting utility

    master

    The TLSFingerprinting utility extracts TLS fingerprinting data (similar to JA3 and JA3S) from pcap/pcapng files or live network interfaces. It identifies ClientHello and/or ServerHello packets and outputs their fingerprints, MD5 hashes, IP addresses, and TCP ports to a CSV file.

    To run the utility, use the following command structure:

    TLSFingerprinting [-hvlcms] [-r input_file] [-i interface] [-o output_file_name] [-s separator] [-t tls_fp_type] [-e bpf_filter]
    TLSFingerprinting [-hvlcms] [-r input_file] [-i interface] [-o output_file_name] [-s separator] [-t tls_fp_type] [-e bpf_filter]

  12. Use the PcapSearch utility to search packet files

    master

    The PcapSearch application searches for packets within .pcap and .pcapng files located in a specified directory and its sub-directories. It uses Berkeley Packet Filter (BPF) syntax to define search patterns. The utility outputs the count of matching packets found in each file to stdout and can optionally generate a detailed report to a file.

    PcapSearch.exe -d C:\ -s "ip net 1.1.1.1" -r C:\report.txt