Module org.jnetpcap

module org.jnetpcap
Native Packet Capture (Pcap) wrapper API and implementation for Unix and Windows platforms. This module provides high-level Java interfaces to packet capture systems through the native libpcap/WinPcap libraries.

Module Overview

The module allows access to all network packets, including those destined for other hosts, through various capture mechanisms. It supports both live packet capture and working with saved capture files ("savefiles").

Core Packages

  • org.jnetpcap - Core API and implementation
  • org.jnetpcap.windows - Windows-specific extensions
  • org.jnetpcap.constant - Constant definitions and enumerations
  • org.jnetpcap.util - Utility classes
  • org.jnetpcap.spi - Service provider interfaces

Using the Module

The primary entry point is the Pcap class, which provides methods for:

Configurable Capture Options

Snapshot Length

Controls how much of each packet is captured. Set via Pcap.setSnaplen(int). A length of 65535 bytes typically captures complete packets on most networks. Smaller values reduce CPU, bandwidth and storage requirements but may truncate packets.

Promiscuous Mode

When enabled via Pcap.setPromisc(boolean), captures all packets on the network segment, not just those addressed to the capture interface. Useful for network analysis but may be restricted on some systems.

Monitor (RFMON) Mode

For wireless interfaces, enables capture of all 802.11 frames including management and control frames via Pcap.setRfmon(boolean). Check support with Pcap.canSetRfmon(). Note that this may disable normal network connectivity.

Buffer Timeout

Controls packet delivery timing through Pcap.setTimeout(int):

  • Zero: Wait indefinitely for buffer to fill
  • Positive value: Maximum wait time for buffering packets
  • Negative values are invalid

Note: Not supported on all platforms and should not be used for polling.

Immediate Mode

When enabled, delivers packets immediately without buffering. Set via Pcap.setImmediateMode(boolean).

Buffer Size

Controls the kernel capture buffer size via Pcap.setBufferSize(int). Larger buffers prevent packet drops during traffic bursts but use more memory. Too small buffers may drop packets under heavy load.

Timestamp Type

Selects the timestamp source for captured packets through Pcap.setTstampType(PcapTstampType). Available types vary by platform and can affect timestamp resolution and synchronization.

Service Providers

The module uses the PcapMessagesProvider service for localization and message handling.

Author:
Mark Bednarczyk [mark@slytechs.com], Sly Technologies Inc.