Introduction

PcapPlusPlus is a A multiplatform C++ library for capturing, parsing and crafting of network packets. It is designed to be efficient, powerful and easy to use.

Please refer to PcapPlusPlus web-site for more information.

API Reference

Packet capturing engines (Pcap++):

pcpp::PcapLiveDevice, PcapLiveDevice.h - wrapper for libPacp engine (Linux)
pcpp::WinPcapLiveDevice, WinPcapLiveDevice.h - wrapper for WinPcap/Npcap engine (Windows)
pcpp::PcapRemoteDevice, PcapRemoteDevice.h - remote live device, supported by WinPcap (Windows)
pcpp::PfRingDevice, PfRingDevice.h - Vanilla PF_RING device (Linux)
pcpp::DpdkDevice, DpdkDevice.h - DPDK device (Linux)
pcpp::RawSocketDevice, RawSocketDevice.h - raw socket wrapper (Windows and Linux)
PcapFilter.h - structured filter engine

Capture file wrappers (Pcap++):

pcpp::PcapFileReaderDevice, PcapFileDevice.h - read Pcap files
pcpp::PcapFileWriterDevice, PcapFileDevice.h - write Pcap files
pcpp::PcapNgFileReaderDevice, PcapFileDevice.h - read PcapNG files
pcpp::PcapNgFileWriterDevice, PcapFileDevice.h - write PcapNG files

Packet parsing and manipulation (Packet++):

pcpp::RawPacket, RawPacket.h - raw data class
pcpp::Packet, Packet.h - parsed packet class
pcpp::Layer, Layer.h - protocol base class

Supported protocols (Packet++):

pcpp::EthLayer, EthLayer.h - Ethernet II protocol
pcpp::EthDot3Layer, EthDot3Layer.h - IEEE 802.3 Ethernet protocol
pcpp::SllLayer, SllLayer.h - SLL protocol (Linux cooked capture)
pcpp::NullLoopbackLayer, NullLoopbackLayer.h - Null/Loopback
pcpp::PacketTrailerLayer, PacketTrailerLayer.h - packet trailer (a.k.a footer or padding)
pcpp::ArpLayer, ArpLayer.h - ARP protocol
pcpp::VlanLayer, VlanLayer.h - VLAN protocol
pcpp::VxlanLayer, VxlanLayer.h - VXLAN protocol
pcpp::MplsLayer, MplsLayer.h - MPLS protocol
pcpp::PPPoESessionLayer, pcpp::PPPoEDiscoveryLayer, PPPoELayer.h - PPPoE protocol
pcpp::GREv0Layer, pcpp::GREv1Layer, pcpp::PPP_PPTPLayer, GreLayer.h - GRE and PPTP protocol
pcpp::IPv4Layer, IPv4Layer.h - IPv4 protocol
pcpp::IPv6Layer, IPv6Layer.h - IPv6 protocol
pcpp::TcpLayer, TcpLayer.h - TCP protocol
pcpp::UdpLayer, UdpLayer.h - UDP protocol
pcpp::GtpV1Layer, GtpLayer.h - GTP (v1) protocol
pcpp::IcmpLayer, IcmpLayer.h - ICMP protocol
pcpp::IgmpLayer, IgmpLayer.h - IGMP protocol
pcpp::AuthenticationHeaderLayer, pcpp::ESPLayer - IPSec AH & ESP - parsing only (no editing capabilities)
pcpp::SipRequestLayer, SipLayer.h - SIP request protocol
pcpp::SipResponseLayer, SipLayer.h - SIP response protocol
pcpp::SdpLayer, SdpLayer.h - SDP protocol
pcpp::RadiusLayer, RadiusLayer.h - RADIUS protocol
pcpp::DnsLayer, DnsLayer.h - DNS protocol
pcpp::DhcpLayer, DhcpLayer.h - DHCP protocol
pcpp::DhcpV6Layer, DhcpV6Layer.h - DHCPv6 protocol
pcpp::BgpLayer, BgpLayer.h - BGP protocol
pcpp::SSHLayer, SSHLayer.h - SSH protocol - parsing only (no editing capabilities)
pcpp::HttpRequestLayer, HttpLayer.h - HTTP request protocol
pcpp::HttpResponseLayer, HttpLayer.h - HTTP response protocol
pcpp::SSLLayer, SSLLayer.h - SSL/TLS protocol - parsing only (no editing capabilities)
pcpp::PayloadLayer, PayloadLayer.h - unknown layer or payload

Common utilities and infrastructure (Common++, Packet++, Pcap++):

pcpp::IPAddress, pcpp::IPv4Address, pcpp::IPv6Address, IpAddress.h - IP address wrapper classes
pcpp::MacAddress, MacAddress.h - MAC address wrapper class
pcpp::TcpReassembly, TcpReassembly.h - Implementation of TCP reassembly logic
pcpp::IPReassembly, IPReassembly.h - Implementation of IP reassembly logic (a.k.a IP de-fragmentation). Works for both IPv4 and IPv6
IpUtils.h - all kinds of helpful network utilities
PacketUtils.h - useful packet processing utils such as creating a hash value for a packet
NetworkUtils.h - several useful and common network utilities
SystemUtils.h - several useful utilities for interactiong with the operating system
pcpp::LoggerPP, Logger.h - PcapPlusPlus logger
PcapPlusPlusVersion.h - version and Git info