Интерфейс pcap для захвата сетевого трафика

Application programming interface for capturing network traffic
the packet sniffing API

In the field of computer network administration, pcap is an application programming interface (API) for capturing network traffic. While the name is an abbreviation of packet capture, that is not the API's proper name. Unix like systems implement pcap in the libpcap library; for Windows, there is a port of libpcap named WinPcap that is no longer supported or developed, and a port named Npcap for Windows 7 and later that is still supported. Monitoring software may use libpcap, WinPcap, or Npcap to capture network packets traveling over a computer network and, in newer versions, to transmit packets on a network at the link layer, and to get a list of network interfaces for possible use with libpcap, WinPcap, or Npcap. The pcap API is written in C, so other languages such as Java, NET languages, and scripting languages generally use a wrapper; no such wrappers are provided by libpcap or WinPcap itself. C++ programs may link directly to the C API or make use of an object oriented wrapper.

libpcap, WinPcap, and Npcap provide the packet capture and filtering engines of many open source and commercial network tools, including protocol analyzers (packet sniffers), network monitors, network intrusion detection systems, traffic generators and network testers. libpcap, WinPcap, and Npcap also support saving captured packets to a file, and reading files containing saved packets; applications can be written, using libpcap, WinPcap, or Npcap, to be able to capture network traffic and analyze it, or to read a saved capture and analyze it, using the same analysis code. A capture file saved in the format that libpcap, WinPcap, and Npcap use can be read by applications that understand that format, such as tcpdump, Wireshark, CA NetMaster, or Microsoft Network Monitor 3. x. The file format is described by Internet Draft draft ietf opsawg pcap; the current editors' version of the draft is also available. The MIME type for the file format created and read by libpcap, WinPcap, and Npcap is application/vnd. tcpdump. pcap. The typical file extension is pcap, although cap and dmp are also in common use.

libpcap was originally developed by the tcpdump developers in the Network Research Group at Lawrence Berkeley Laboratory. The low level packet capture, capture file reading, and capture file writing code of tcpdump was extracted and made into a library, with which tcpdump was linked. It is now developed by the same tcpdump. org group that develops tcpdump.

While libpcap was originally developed for Unix like operating systems, a successful port for Windows was made, called WinPcap. It has been unmaintained since 2013, and several competing forks have been released with new features and support for newer versions of Windows.

Win10Pcap implementation is also based on the NDIS 6 driver model and works stably with Windows 10. The project, however, has been inactive since 2016.

Apache Drill, an open source SQL engine for interactive analysis of large scale datasets. Endace's EndaceProbe, a high scale packet capture system that continuously records weeks or months of network traffic.