Module org.jnetpcap

Package org.jnetpcap

package org.jnetpcap
The Packet Capture library provides a high level interface to packet capture systems. All packets on the network, even those destined for other hosts, are accessible through this mechanism. It also supports saving captured packets to a ``savefile'', and reading packets from a ``savefile''.

Opening a capture handle for reading

To open a handle for a live capture, given the name of the network or other interface on which the capture should be done, call pcap_create(), set the appropriate options on the handle, and then activate it with Pcap.activate(). If pcap_activate() fails, the handle should be closed with Pcap.close().

To obtain a list of devices that can be opened for a live capture, call Pcap.findAllDevs(); the list is automatically freed by jNePcap. Pcap.lookupDev() will return the first device on that list that is not a ``loopback`` network interface.

To open a handle for a ``savefile'' from which to read packets, given the pathname of the ``savefile'', call pcap_open_offline(); to set up a handle for a ``savefile'', given a FILE * referring to a file already opened for reading, call Pcap.openOffline(java.io.File).

In order to get a ``fake'' pcap_t for use in routines that require a pcap_t as an argument, such as routines to open a ``savefile'' for writing and to compile a filter expression, call Pcap.openDead(org.jnetpcap.constant.PcapDlt, int).

Pcap.create(org.jnetpcap.PcapIf), Pcap.openOffline(java.io.File), pcap_fopen_offline(), and Pcap.openDead(org.jnetpcap.constant.PcapDlt, int) return a pointer to a pcap_t, which is the handle used for reading packets from the capture stream or the ``savefile'', and for finding out information about the capture stream or ``savefile''. To close a handle, use pcap_close().

Here is an example which uses PcapReceiver and several of its functional packet handler interfaces. 

 
try (Pcap pcap = Pcap.openOffline(PCAP_FILE)) {

        BpFilter filter = pcap.compile("tcp", true);

        pcap.setFilter(filter);

        pcap.loop(1, PcapExample1::nextDefault, "Hello, this is a copy to byte[] dispatch");
        pcap.loop(1, PcapExample1::nextByteBuffer, "Hello, this is a no-copy to ByteBuffer dispatch");
}
...
private static void nextByteBuffer(String message, PcapHeader header, ByteBuffer packet) {

        System.out.println(message);
        System.out.printf("Packet [timestamp=%s, wirelen=%-4d caplen=%-4d %s]%n",
                        Instant.ofEpochMilli(header.toEpochMillis()),
                        header.wireLength(),
                        header.captureLength(),
                        PcapUtils.toHexCurleyString(packet.limit(6)));
}

private static void nextDefault(String message, PcapHeader header, byte[] packet) {

        System.out.println(message);
        System.out.printf("Packet [timestamp=%s, wirelen=%-4d caplen=%-4d %s]%n",
                        Instant.ofEpochMilli(header.toEpochMillis()),
                        header.wireLength(),
                        header.captureLength(),
                        PcapUtils.toHexCurleyString(packet, 0, 6));
}
Output: 
Hello, this is a copy to byte[] dispatch
Packet [timestamp=2011-03-01T20:45:13.266Z, wirelen=74   caplen=74   {00:26:62:2f:47:87}]
Hello, this is a no-copy to ByteBuffer dispatch
Packet [timestamp=2011-03-01T20:45:13.313Z, wirelen=74   caplen=74   {00:1d:60:b3:01:84}]
Author:
Sly Technologies, repos@slytechs.com