Documentation

Introduction

PcapPlusPlus is a multiplatform C++ network sniffing and packet parsing and manipulation framework.
PcapPlusPlus is meant to be lightweight, efficient and easy to use.

Installation

Please visit the PcapPlusPlus web-site in order to see download and installation instructions.

Getting Started

Packet capturing engines (Pcap++):

• pcpp::PcapLiveDevice, PcapLiveDevice.h - wrapper for libPacp engine (Linux)
• pcpp::WinPcapLiveDevice, WinPcapLiveDevice.h - wrapper for WinPcap engine (Windows)
• pcpp::PcapRemoteDevice, PcapRemoteDevice.h - remote live device, supported by WinPcap(Windows)
• pcpp::PfRingDevice, PfRingDevice.h - Vanilla PF_RING device (Linux)
• pcpp::DpdkDevice, DpdkDevice.h - DPDK device (Linux)
• PcapFilter.h - structured filter engine

Capture file wrappers (Pcap++):

• pcpp::PcapFileReaderDevice, PcapFileDevice.h - read Pcap files
• pcpp::PcapFileWriterDevice, PcapFileDevice.h - write Pcap files
• pcpp::PcapNgFileReaderDevice, PcapFileDevice.h - read PcapNG files
• pcpp::PcapNgFileWriterDevice, PcapFileDevice.h - write PcapNG files

Packet parsing and manipulation (Packet++):

• pcpp::RawPacket, RawPacket.h - raw data class
• pcpp::Packet, Packet.h - parsed packet class
• pcpp::Layer, Layer.h - protocol base class

Supported protocols (Packet++):

• pcpp::EthLayer, EthLayer.h - Ethernet protocol
• pcpp::SllLayer, SllLayer.h - SLL protocol (Linux cooked capture)
• pcpp::NullLoopbackLayer, NullLoopbackLayer.h - Null/Loopback
• pcpp::PacketTrailerLayer, PacketTrailerLayer.h - packet trailer (a.k.a footer or padding)
• pcpp::ArpLayer, ArpLayer.h - ARP protocol
• pcpp::VlanLayer, VlanLayer.h - VLAN protocol
• pcpp::VxlanLayer, VxlanLayer.h - VXLAN protocol
• pcpp::MplsLayer, MplsLayer.h - MPLS protocol
• pcpp::PPPoESessionLayer, pcpp::PPPoEDiscoveryLayer, PPPoELayer.h - PPPoE protocol
• pcpp::GREv0Layer, pcpp::GREv1Layer, pcpp::PPP_PPTPLayer, GreLayer.h - GRE and PPTP protocol
• pcpp::IPv4Layer, IPv4Layer.h - IPv4 protocol
• pcpp::IPv6Layer, IPv6Layer.h - IPv6 protocol
• pcpp::TcpLayer, TcpLayer.h - TCP protocol
• pcpp::UdpLayer, UdpLayer.h - UDP protocol
• pcpp::IcmpLayer, IcmpLayer.h - ICMP protocol
• pcpp::IgmpLayer, IgmpLayer.h - IGMP protocol
• pcpp::SipRequestLayer, SipLayer.h - SIP request protocol
• pcpp::SipResponseLayer, SipLayer.h - SIP response protocol
• pcpp::SdpLayer, SdpLayer.h - SDP protocol
• pcpp::DnsLayer, DnsLayer.h - DNS protocol
• pcpp::DhcpLayer, DhcpLayer.h - DHCP protocol
• pcpp::HttpRequestLayer, HttpLayer.h - HTTP request protocol
• pcpp::HttpResponseLayer, HttpLayer.h - HTTP response protocol
• pcpp::SSLLayer, SSLLayer.h - SSL/TLS protocol - parsing only (no editing capabilities)
• pcpp::PayloadLayer, PayloadLayer.h - unknown layer or payload

Common utilities and infrastructure (Common++, Packet++, Pcap++):

• pcpp::IPAddress, pcpp::IPv4Address, pcpp::IPv6Address, IpAddress.h - IP address wrapper classes
• pcpp::MacAddress, MacAddress.h - MAC address wrapper class
• pcpp::TcpReassembly, TcpReassembly.h - Implementation of TCP reassembly logic
• pcpp::IPReassembly, IPReassembly.h - Implementation of IP reassembly logic (a.k.a IP de-fragmentation). Works for both IPv4 and IPv6
• IpUtils.h - all kinds of helpful network utilities
• PacketUtils.h - useful packet processing utils such as creating a hash value for a packet
• NetworkUtils.h - several useful and common network utilities
• SystemUtils.h - several useful utilities for interactiong with the operating system
• pcpp::LoggerPP, Logger.h - PcapPlusPlus logger
• PcapPlusPlusVersion.h - version and Git info