Welcome To PcapPlusPlus!

A multiplatform C++ library for capturing, parsing and crafting of network packets. It is designed to be efficient, powerful and easy to use.

Get started Download

Capture and send network traffic

PcapPlusPlus enables capturing and sending network packets through easy-to-use C++ wrappers for the most popular packet processing engines such as libpcap, WinPcap, Npcap, DPDK and PF_RING

Learn More

Decode and forge packets

PcapPlusPlus enables decoding and forging capabilities for a large variety of network protocols

Learn More
// parse the raw packet into a parsed packet
pcpp::Packet parsedPacket(&rawPacket);

// check if it's an IPv4 packet
if (parsedPacket.isPacketOfType(pcpp::IPv4)) {
  // extract source and dest IPs
  pcpp::IPv4Address srcIP = 
    parsedPacket.getLayerOfType()->getSrcIpAddress();
  pcpp::IPv4Address destIP = 
    parsedPacket.getLayerOfType()->getDstIpAddress();

  // print source and dest IPs
  printf("Source IP is '%s'; Dest IP is '%s'\n", 
    srcIP.toString().c_str(), destIP.toString().c_str());
}

Super Fast!

PcapPlusPlus is designed to be efficient and lightweight. It enables amazingly fast packet processing with minimum overhead

View Benchmarks

Multiplatform support

PcapPlusPlus is fully supported on Windows, MacOS, Linux and FreeBSD. You can download pre-built binaries for each platform or build it from source. PcapPlusPlus is available in popular package managers such as Homebrew and Conan

View Installation Guide

Read and write packets to files

PcapPlusPlus provides an easy-to-use interface for reading and writing network packets into files. It supports the most popular file formats which are PCAP and PCAPNG

Learn More
// create a pcap file reader
pcpp::PcapFileReaderDevice pcapReader("input.pcap");
pcapReader.open();

// create a pcapng file writer
pcpp::PcapNgFileWriterDevice pcapNgWriter("output.pcapng");
pcapNgWriter.open();

// raw packet object
pcpp::RawPacket rawPacket;

// read packets from pcap reader and write pcapng writer
while (pcapReader->getNextPacket(rawPacket)) {
  pcapNgWriter.writePacket(rawPacket);
}

Packet reassembly

PcapPlusPlus contains unique implementation of packet reassembly techniques.

TCP Reassembly which supports TCP retransmission, out-of-order TCP packets and missing TCP data

IP Fragmentation and Defragmentation to create and reassemble IPv4 and IPv6 fragments

Learn More