Jump to content

pcap

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Guy Harris (talk | contribs) at 02:08, 13 March 2016 (→Programs that use libpcap/WinPcap: Given that libpcap was a library sliced from tcpdump, give tcpdump pride of place in the list.). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

This article is about the packet sniffing API. For the projected capacitance technology for touchscreens, see projected capacitance.
libpcap
Developer(s)The Tcpdump team
Stable release
1.7.3 / April 22, 2015 (2015-04-22)[1]
Operating systemLinux, Solaris, FreeBSD, NetBSD, OpenBSD, OS X, additional *NIX systems
TypeLibrary for packet capture
LicenseBSD license[2]
Websitewww.tcpdump.org
WinPcap
Developer(s)Riverbed Technology
Stable release
4.1.3 / March 8, 2013 (2013-03-08)[3]
Operating systemMicrosoft Windows
TypeLibrary for packet capture
LicenseFreeware
Websitewww.winpcap.org

In the field of computer network administration, pcap (packet capture) consists of an application programming interface (API) for capturing network traffic. Unix-like systems implement pcap in the libpcap library; Windows uses a port of libpcap known as WinPcap.

Monitoring software may use libpcap and/or WinPcap to capture packets travelling over a network and, in newer versions, to transmit packets on a network at the link layer, as well as to get a list of network interfaces for possible use with libpcap or WinPcap.

The pcap API is written in C, so other languages such as Java, .NET languages, and scripting languages generally use a wrapper; no such wrappers are provided by libpcap or WinPcap itself. C++ programs may link directly to the C API or use an object-oriented wrapper.

Features

libpcap and WinPcap provide the packet-capture and filtering engines of many open source and commercial network tools, including protocol analyzers (packet sniffers), network monitors, network intrusion detection systems, traffic-generators and network-testers.

libpcap and WinPcap also support saving captured packets to a file, and reading files containing saved packets; applications can be written, using libpcap or WinPcap, to be able to capture network traffic and analyze it, or to read a saved capture and analyze it, using the same analysis code. A capture file saved in the format that libpcap and WinPcap use can be read by applications that understand that format, such as tcpdump, Wireshark, CA NetMaster, or Microsoft Network Monitor 3.x.

The MIME type for the file format created and read by libpcap and WinPcap is application/vnd.tcpdump.pcap. The typical file extension is .pcap, although .cap and .dmp are also in common use.[4]

libpcap

libpcap was originally developed by the tcpdump developers in the Network Research Group at Lawrence Berkeley Laboratory. The low-level packet capture, capture file reading, and capture file writing code of tcpdump was extracted and made into a library, with which tcpdump was linked.[5] It is now developed by the same tcpdump.org group that develops tcpdump.[6]

WinPcap

WinPcap consists of:[7]

Programmers at the Politecnico di Torino wrote the original code; as of 2008 CACE Technologies, a company set up by some of the WinPcap developers, develops and maintains the product. CACE Technologies was acquired by Riverbed Technology on October 21, 2010.[8]

Programs that use libpcap/WinPcap

  • tcpdump, a tool for capturing and dumping packets for further analysis, and WinDump, the Windows port of tcpdump.
  • Cain and Abel, a password recovery tool for Microsoft Windows
  • ngrep, aka "network grep", isolate strings in packets, show packet data in human-friendly output.
  • Wireshark (formerly Ethereal), a graphical packet-capture and protocol-analysis tool.
  • Snort, a network-intrusion-detection system.
  • Nmap, a port-scanning and fingerprinting network utility
  • the Bro IDS and network-monitoring platform.
  • URL Snooper, locate the URLs of audio and video files in order to allow recording them.
  • Kismet, for 802.11 wireless LANs
  • L0phtCrack, a password auditing and recovery application.
  • iftop, a tool for displaying bandwidth usage (like top for network traffic)
  • EtherApe, a graphical tool for monitoring network traffic and bandwidth usage in real time.
  • Bit-Twist, a libpcap-based Ethernet packet generator and editor for BSD, Linux, and Windows.
  • Pirni, a network security tool for jailbroken iOS devices.
  • McAfee ePolicy Orchestrator, Rogue System Detection feature
  • NetSim a network simulation software for network R & D
  • XLink Kai Software that allows various LAN console games to be played online
  • Firesheep, an extension for the Firefox web browser that captures packets and performs session hijacking
  • Suricata, a network intrusion prevention and analysis platform.
  • WhatPulse, a statistical (input, network, uptime) measuring application.
  • Xplico, a network forensics analysis tool (NFAT).
  • Scapy, a packet manipulation tool for computer networks, written in Python by Philippe Biondi.

Wrapper libraries for libpcap/WinPcap

Non-pcap code that reads pcap files

References

  1. ^ "tcpdump and libpcap latest release". tcpdump.org. Retrieved 2015-05-31.
  2. ^ "tcpdump and libpcap license". tcpdump.org. Retrieved 2012-04-13.
  3. ^ "WinPcap Changelog".
  4. ^ "IANA record of application for MIME type application/vnd.tcpdump.pcap".
  5. ^ Steve McCanne. "libpcap: An Architecture and Optimization Methodology for Packet Capture" (PDF). Retrieved December 27, 2013.
  6. ^ "TCPDUMP/LIBPCAP public repository". Retrieved December 27, 2013.
  7. ^ "WinPcap internals". Retrieved December 27, 2013.
  8. ^ "Riverbed Expands Further Into The Application-Aware Network Performance Management Market with the Acquisition of CACE Technologies". Riverbed Technology. 2010-10-21. Retrieved 2010-10-21.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Pcap&oldid=709785217"