Stack Overflow
Stack Overflow

Questions tagged [libpcap]

Libpcap, a portable C/C++ library for network traffic capture. Provides a common interface across various OS-specific backends like BPF, packet filter, netfilter, and NPF.

Libpcap was originally developed by the tcpdump developers in the Network Research Group at Lawrence Berkeley Laboratory. The low-level packet capture, capture file reading, and capture file writing code of tcpdump was extracted and made into a library, with which tcpdump was linked.

796 questions
4
votes
4 answers

How separate RTP packets from the rest

I got a pcap file with voip conversation, how i can separate RTP packets from the other packets? I can obtain sip packets, but I can't differenciate the RTP packets from the rest.
user1027524
  • 141
  • 3
  • 7
4
votes
3 answers

iptables and libpcap

i have rule set up to drop udp/tcp packets with matching strings. however, my program which captures packet using libpcap, is still able to see this packet. Why is this/, what should be the iptable rules to drop packets before it is seen by…
Kazoom
  • 5,659
  • 16
  • 56
  • 69
4
votes
1 answer

How can I capture dns packets in c?

I'm writing a packet sniffer program in c. Now it can only find HTTP packets but I want to make it in a way to get also DNS packets. I know DNS packets are UDP but I don't know how to identify DNS ones. Is there a specific thing in DNS packets to…
Amir reza Riahi
  • 1,540
  • 2
  • 8
  • 34
4
votes
2 answers

Can I use pcap library for receiving ipv6 packets?

I am trying to convert hping3 to hping6. hping3 uses Pcap library to receive IPv4 packets. But I need to receive IPv6 packets.
Adi
  • 1,589
  • 3
  • 19
  • 27
4
votes
1 answer

TLS decryption using libpcap

I'd like to inspect network data from a recorded pcap file. Specifically, websockets traffic. I'm using python websockets library as a client if it matters. Anyway, I'm recording all the session and setting the environment variable SSLKEYLOGFILE for…
user1912594
  • 365
  • 3
  • 10
4
votes
0 answers

Android NDK: Trying to port JnetPcap

I found a traffic monitoring application for Android, Shark, which is based on JnetPcap and has a file with all the source files and the appropriate Android.mk files. I put the jni directory in the samples file of the Android-NDK and I tried to…
Thanasis Petsas
  • 4,378
  • 5
  • 31
  • 57
4
votes
0 answers

Libtins TCP stream missing packet?

First of all, thanks for your patience. This issue may only be due to my lack of understanding as I am a complete beginner in PDU, ... I am trying to do some TCP stream reassembling using libtins in order to measure some metrics. The issue is,…
Namoz
  • 540
  • 2
  • 14
4
votes
1 answer

Reading a TCP header and managing a TCP connection with RAW_SOCKET

I'm trying to get the TCP header of a TCP connection in C++11. Reading through already existing StackOverflow questions (here, here, here and here) it seems like I have to open a RAW_SOCKET or to write a Linux Kernel Module (LKM) to have access to…
Polpetta
  • 495
  • 1
  • 3
  • 13
4
votes
1 answer

Deploying an app with root privileges

I have written a Cocoa app which uses libpcap to monitor network traffic. Since libpcap requires root privileges I was wondering what's the best way to give it root privileges (e.g. using Package Maker?). Would I be able to deploy it using a…
CodeWombat
  • 778
  • 2
  • 7
  • 26
4
votes
3 answers

libpcap setfilter() function and packet loss

this is my first question here @stackoverflow. I'm writing a monitoring tool for some VoIP production servers, particularly a sniff tool that allows to capture all traffic (VoIP calls) that match a given pattern using pcap library in Perl. I cannot…
Guido
  • 341
  • 5
  • 18
4
votes
2 answers

the correct way to use pcap_next_ex or pcap_next (libpcap)

I saw this kind of code used in a project: while (1) { l_numPkts = pcap_next_ex( m_pcapHandle, &header, &pkt_data); //do something memcpy(dst,pkt_data,size); } after the pcap_next_ex return,the packet status will be set…
jon
  • 395
  • 1
  • 3
  • 21
4
votes
1 answer

libpcap: Delay between receiving frames and call of callback-function

i am experiencing the following situation: I open with pcap_open_live() one of my network-interfaces. Then i am compiling a filter for pcap for only capturing a specified ethernet-type (ether proto 0x1234). Now i am starting the pcap_loop(). The…
Joojoo
  • 79
  • 5
4
votes
1 answer

Differentiate between RTP and RTCP packet multiplexed on same port

I am using Tcpdumpto capture packets on my network interface. In Wireshark i can see that RTP and RTCP transactions are going on the same port. I am writing a dissector using Libpcap which will parse and save all the RTP and RTCP packets in…
Adi Tiwari
  • 761
  • 1
  • 5
  • 17
4
votes
1 answer

Why is pcap_datalink() always returning 1 (Ethernet), even on wireless device?

I'm having an issue where by pcap_datalink() is always returning 1. To my understanding this is LINKTYPE_ETHERNET. But, the device I am using is a wireless card and in my case en0. This is stopping me from putting the card into monitor mode, and…
James Jeffery
  • 12,093
  • 19
  • 74
  • 108
4
votes
1 answer

How similar are Pcap and WinPcap?

I'm trying to do cross-platform development, windows 7 host, QNX Neutrino target. Before trying to get the cross-platform development working, I'd like to test and play around with the code on my host, but Pcap isn't supported on Windows. How…
GreySage
  • 1,153
  • 19
  • 39
1 2 3
…
53 54