In the field of computer network administration, pcap consists of an
application programming interface for capturing network traffic. Unix-like
systems implement pcap in the libpcap library; Windows uses a port of libpcap
known as WinPcap. Monitoring software may use libpcap
and/or WinPcap to capture packets travelling over a network and, in newer
versions, to transmit packets on a network at the link layer, as well as to
get a list of network interfaces for possible use with libpcap or WinPcap.
The pcap API is written in C, so other languages such as Java, .NET languages,
and scripting languages generally use a wrapper; no such wrappers are provided
by libpcap or WinPcap itself. C++ programs may link directly to the C API
or use an object-oriented wrapper. Features
libpcap and WinPcap provide the packet-capture and filtering engines of
many open source and commercial network tools, including protocol analyzers,
network monitors, network intrusion detection systems, traffic-generators
and network-testers. libpcap and WinPcap also support saving
captured packets to a file, and reading files containing saved packets;
applications can be written, using libpcap or WinPcap, to be able to
capture network traffic and analyze it, or to read a saved capture and analyze
it, using the same analysis code. A capture file saved in the format that
libpcap and WinPcap use can be read by applications that understand that
format, such as tcpdump, Wireshark, CA NetMaster, or Microsoft Network Monitor
3.x. The MIME type for the file format
created and read by libpcap and WinPcap is application/vnd.tcpdump.pcap. The
typical file extension is .pcap, although .cap and .dmp are also in
common use. libpcap
libpcap was originally developed by the tcpdump developers in the Network
Research Group at Lawrence Berkeley Laboratory. The low-level packet
capture, capture file reading, and capture file writing code of tcpdump was
extracted and made into a library, with which tcpdump was linked. It is now
developed by the same tcpdump.org group that develops tcpdump.
WinPcap WinPcap consists of:
x86 and x86-64 drivers for the Windows NT family, which use NDIS to read
packets directly from a network adapter; implementations of a lower-level library
for the listed operating systems, to communicate with those drivers;
a port of libpcap that uses the API offered by the low-level library
implementations. Programmers at the Politecnico di Torino
wrote the original code; as of 2008 CACE Technologies, a company set up by some
of the WinPcap developers, develops and maintains the product. CACE Technologies
was acquired by Riverbed Technology on October 21, 2010.
Programs that use libpcap/WinPcap tcpdump, a tool for capturing and
dumping packets for further analysis, and WinDump, the Windows port of
tcpdump. ngrep, aka "network grep", isolate
strings in packets, show packet data in human-friendly output.
Wireshark, a graphical packet-capture and protocol-analysis tool.
Snort, a network-intrusion-detection system.
Nmap, a port-scanning and fingerprinting network utility
the Bro IDS and network-monitoring platform.
URL Snooper, locate the URLs of audio and video files in order to allow
recording them. Kismet, for 802.11 wireless LANs
L0phtCrack, a password auditing and recovery application.
iftop, a tool for displaying bandwidth usage
EtherApe, a graphical tool for monitoring network traffic and bandwidth
usage in real time. Bit-Twist, a libpcap-based Ethernet
packet generator and editor for BSD, Linux, and Windows.
Pirni, a network security tool for jailbroken iOS devices.
McAfee ePolicy Orchestrator, Rogue System Detection feature
NetSim a network simulation software for network R & D
XLink Kai Software that allows various LAN console games to be played online
Firesheep, an extension for the Firefox web browser, that intercepts unencrypted
cookies from certain websites as the cookies are transmitted over networks,
exploiting session hijacking vulnerabilities.
Suricata, a network intrusion prevention and analysis platform.
WhatPulse, a statistical measuring application.
Xplico, a network forensics analysis tool.
Scapy, a packet manipulation tool for computer networks, written in Python by
Philippe Biondi. Wrapper libraries for libpcap/WinPcap
Perl: Net::Pcap Python: python-libpcap, Pcapy
Ruby: PacketFu Tcl: tclpcap, tcap, pktsrc
Java: jpcap, jNetPcap, Jpcap, Pcap4j .NET: WinPcapNET, SharpPcap, Pcap.Net
Haskell: pcap OCaml: mlpcap
Chicken Scheme: pcap Common Lisp: PLOKAMI
Racket: SPeaCAP Go: pcap by Andreas Krennmair, pcap fork
of the previous by Miek Gieben, pcap developed as part of the gopacket
package Non-pcap code that reads pcap files
Python: pycapfile References
^ "tcpdump and libpcap latest release". tcpdump & libpcap. Retrieved 2015-05-31.
^ "tcpdump and libpcap license". tcpdump & libpcap. Retrieved 2012-04-13.
^ "WinPcap Changelog". ^ "IANA record of application for MIME
type application/vnd.tcpdump.pcap". ^ Steve McCanne. "libpcap: An
Architecture and Optimization Methodology for Packet Capture".
Retrieved December 27, 2013. ^ "TCPDUMP/LIBPCAP public repository".
Retrieved December 27, 2013. ^ "WinPcap internals". Retrieved
December 27, 2013. ^ "Riverbed Expands Further Into The
Application-Aware Network Performance Management Market with the Acquisition
of CACE Technologies". Riverbed Technology. 2010-10-21. Retrieved
2010-10-21. External links
Official site for libpcap Official site for WinPcap
List of publicly available PCAP files