A Java library for capturing, crafting, and sending packets.

Last update: Dec 30, 2022

Overview

Pcap4J

Pcap4J is a Java library for capturing, crafting and sending packets. Pcap4J wraps a native packet capture library (libpcap, WinPcap, or Npcap) via JNA and provides you Java-Oriented APIs.

Download
Why Pcap4J was born
Features
How to use
How to build
Contributing Code
License
Contacts

Download

Pcap4J is available on the Maven Central Repository.

Pcap4J 1.8.2
- without source: pcap4j-distribution-1.8.2-bin.zip
- with source: pcap4j-distribution-1.8.2-src.zip
Snapshot builds
- https://oss.sonatype.org/content/repositories/snapshots/org/pcap4j/pcap4j-distribution/

Why Pcap4J was born

I have been developing an SNMP network simulator (SNeO, available at the link below) by Java, which needed to capture packets and I found the pcap was useful for it. Although there are some implementations of the pcap such as libpcap (for UNIX) and WinPcap (for Windows), because they are both native libraries, a Java wrapper library was necessary in order to use them for SNeO. I researched it and found three Java wrapper libraries for pcap: jpcap, jNetPcap, and Jpcap. But both jpcap and jNetPcap were unsuitable for SNeO because they seemed to be designed for mainly capturing packets and not to be useful for making and sending packets so much. On the other hand, Jpcap looked useful for making and sending packets. But it had a defect in capturing ICMP packets and its development seemed to be stopped long ago. That's why I started developing Pcap4j.

Features

Capturing packets via a network interface and converting them into Java objects. You can get/set each field of a packet header via the Java object converted from the packet. You can also craft a packet object from scratch.
Sending packet objects to a real network.
Supported protocols:
- Ethernet, Linux SLL, raw IP, PPP (RFC1661, RFC1662), BSD (Mac OS X) loopback encapsulation, and Radiotap
- IEEE 802.11
  - Probe Request
- LLC and SNAP
- IEEE802.1Q
- ARP
- IPv4 (RFC791 and RFC1349) and IPv6 (RFC2460)
- ICMPv4 (RFC792) and ICMPv6 (RFC4443, RFC4861, and RFC6275)
- TCP (RFC793, RFC2018, and draft-ietf-tcpm-1323bis-21), UDP, and SCTP (only common header)
- GTPv1 (only GTP-U and GTP-C header)
- DNS (RFC1035, RFC3596, and RFC6844)
All built-in packet classes are serializable and thread-safe (practically immutable).
You can add a protocol support without modifying Pcap4J library itself.
Dumping and reading pcap-formatted files (e.g. a capture file of Wireshark).

How to use

System requirements

Dependencies

Pcap4j 1.1.0 or older needs Java 5.0+. Pcap4j 1.2.0 or newer needs Java 6.0+. And also a pcap native library (libpcap 1.0.0+, WinPcap 3.0+, or Npcap), jna, slf4j-api, and an implementation of logger for slf4j are required. I'm using the following libraries for the test.

libpcap 1.1.1
WinPcap 4.1.2
jna 5.1.0
slf4j-api 1.7.25
logback-core 1.0.0
logback-classic 1.0.0

Platforms

I tested Pcap4j on the following OSes with x86 or x64 processors.

Windows: XP, Vista, 7, 10, 2003 R2, 2008, 2008 R2, and 2012
Linux
- RHEL: 5, 6, and 7
- CentOS: 5, 6, and 7
- Ubuntu: 13
UNIX
- Solaris: 10
- FreeBSD: 10

And tomute tested Pcap4j on Mac OS X. The report is here. Thank you, tomute!

I hope Pcap4j can run on the other OSes supported by both JNA and libpcap.

Others

Pcap4J needs administrator/root privileges. Or, if on Linux, you can run Pcap4J with a non-root user by granting capabilities CAP_NET_RAW and CAP_NET_ADMIN to your java command by the following command: setcap cap_net_raw,cap_net_admin=eip /path/to/java

Documents

The latest JavaDoc is here. Each version's JavaDoc is on the Maven Central Repository.

Refer to here for information about Pcap4J modules.

Because Pcap4J is a wrapper of a pcap native library, the following documents help you to understand how to use Pcap4J.

You can learn how to write Pcap4J programs from samples.

Learn more about Pcap4j from the following documents:

How to run samples

See the following examples:

If you want to run a sample in pcap4j-sample on Eclipse, add pcap4j-packetfactory-static or pcap4j-packetfactory-propertiesbased project to the top of User Entries in Classpath tab of the Run Configuration for the sample.

How to use in Maven project

Add a dependency to the pom.xml as like below:

<project xmlns="http://maven.apache.org/POM/4.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
                      http://maven.apache.org/xsd/maven-4.0.0.xsd">
  ...
  <dependencies>
    <dependency>
      <groupId>org.pcap4j</groupId>
      <artifactId>pcap4j-core</artifactId>
      <version>1.8.2</version>
    </dependency>
    <dependency>
      <groupId>org.pcap4j</groupId>
      <artifactId>pcap4j-packetfactory-static</artifactId>
      <version>1.8.2</version>
    </dependency>
       ...
  </dependencies>
  ...
</project>

About native library loading

By default, Pcap4j loads the native libraries on the following conditions:

Windows
- search path: The paths in the PATH environment variable, etc. (See MSDN for the details.)
- file name: wpcap.dll and Packet.dll
Linux/UNIX
- search path: The search paths of shared libraries configured on the OS. (e.g. The paths in the LD_LIBRARY_PATH environment variable)
- file name: libpcap.so
Mac OS X
- search path: The search paths of shared libraries configured on the OS. (e.g. The paths in the DYLD_LIBRARY_PATH environment variable)
- file name: libpcap.dylib

You can use the following Java system properties to change the default behavior.

jna.library.path: The search path
org.pcap4j.core.pcapLibName: The full path of the pcap library (wpcap.dll, libpcap.so, or libpcap.dylib)
(Windows only) org.pcap4j.core.packetLibName: The full path of the packet library (Packet.dll)

WinPcap or Npcap

There are two native pcap libraries for Windows; WinPcap and Npcap.

The development of WinPcap has stopped since version 4.1.3 (libpcap 1.0.0 base) was released on 3/8/2013, while Npcap is still being developed. So, you should pick Npcap if you want to use new features or so.

Pcap4J can load WinPcap without tricks because it's installed in %SystemRoot%\System32\.

On the other hand, because Npcap is installed in %SystemRoot%\System32\Npcap\ by default, you need to do either of the following so that Pcap4J can load it:

Add %SystemRoot%\System32\Npcap\ to PATH.
Set jna.library.path to %SystemRoot%\System32\Npcap\.
Set org.pcap4j.core.pcapLibName to %SystemRoot%\System32\Npcap\wpcap.dll and org.pcap4j.core.packetLibName to %SystemRoot%\System32\Npcap\Packet.dll.
Install Npcap with WinPcap Compatible Mode on.

Docker

A Docker image for Pcap4J on CentOS is available at Docker Hub.

Download it by docker pull kaitoy/pcap4j and execute docker run kaitoy/pcap4j:latest to start capturing packets from eth0 on the container.

This image is built everytime a commit is made on the Git repositry.

How to build

Install libpcap, WinPcap, or Npcap:

Install WinPcap (if Windows) or libpcap (if Linux/UNIX). It's needed for the unit tests which are run during a build.
Install JDK:

Download and install JDK 9, 10, or 11, and set the environment variable JAVA_HOME properly.

Add the JDK to Maven toolchains:

Create toolchains.xml describing the JDK installed at the previous step and put it into ~/.m2/. toolchains.xml is like below:

<?xml version="1.0" encoding="UTF-8"?>
<toolchains xmlns="http://maven.apache.org/TOOLCHAINS/1.1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/TOOLCHAINS/1.1.0 http://maven.apache.org/xsd/toolchains-1.1.0.xsd">
  <toolchain>
    <type>jdk</type>
    <provides>
      <version>11</version>
    </provides>
    <configuration>
      <jdkHome>/path/to/jdk-11</jdkHome>
    </configuration>
  </toolchain>
</toolchains>

Install Git:

Download Git and install it. This step is optional.
Clone the Pcap4J repository:

If you installed Git, execute the following command: git clone [email protected]:kaitoy/pcap4j.git
Otherwise, download the repository as a zip ball and extract it.
Build:

Open a command prompt/a terminal, cd to the project root directory, and execute ./mvnw install. Note Administrator/root privileges are needed for the unit tests.

Contributing Code

Fork this repository.
Create a branch from v1 branch.
Write code.
- Please refer to This PR as an example when adding protocol support.
- This project follows Google Java Style Guide. Execute the following command to format your code: mvnw com.coveo:fmt-maven-plugin:format
Send a PR from the branch.

License

LICENSE

Contacts

Kaito Yamada ([email protected])

Comments

How parse the packet after get from pcap file by getNextPacketEx

By refer to ReadPacketFile example, we know that it's easy to get whole packet from PcapHandle. Can we do decode the packet content layer by layer?

For example: Ethernet II->Dot1QVlanTang->IPV6->TCP....

Thank you very much.
question

opened by cetsupport 44

can't get payload of TCP packet

Hi, Kaitory:

  I am using getNextPacketEx() to get response tcp packet from server,   the PSH flag of the tcp packet is true,  so the packet should contain payload,   but when i use getPayload() , it returns null.
 ( I am doing this on SuSe linux Enterprise Server 10,  libpcap 1.8.1)

  But  the payload can be captured in normally when the program run on windows.

  Could you please give me some advise？ thanks a lot:)

the scene is very simple: i have run the capture program on both side (client / server).

  1. client(windows/browser) post an http request to the server(SuSE/Tomcat)  
  2. server response an html page to the client

question pcap native library

opened by QiuZidane 18

Help wanted. No NIF was found.
I have run pcap4j on RaspBerryPI3 and everything is great. Now I run it on another small computer board and I get this error:

2018-06-27 19:19:05 [main] 822 INFO org.pcap4j.core.NativeMappings - Pcap4J successfully loaded a native pcap library: libpcap version 1.7.4 2018-06-27 19:19:06 [main] 1496 INFO org.pcap4j.core.Pcaps - No NIF was found.

There is a libpcap-dev installed and I can run tcpdump on the interface I would like to listen in on. But I keep getting this error. I do start my code as root. OS is Ubuntu 16.04 Libpcap v. 1.7.4 Arm64 Processor.

I have tried to reinstall all libpcap* packages and I can get the code ot fail if there are no libpcap installed. Ok, please help.

Thanks.
pcap native library discussion
opened by kaaquist 13
Initial support for SCTP protocol.

This commits adds support for processing the headers for SCTP packets. This does not include support for any interpretation of the packet payload of SCTP data chunks. This also does no validation of the checksum value in the header.

opened by jeffreymyers 13

java.lang.NullPointerException: null for tun0 interface (is my fix reasonable?)

[INFO] Scanning for projects...
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO] 
[INFO] Pcap4J
[INFO] Pcap4J Core
[INFO] Pcap4J Packet Test
[INFO] Pcap4J Static Packet Factory
[INFO] Pcap4J Properties-Based Packet Factory
[INFO] Pcap4J Sample
[INFO] Pcap4J Distribution
[INFO]                                                                         
[INFO] ------------------------------------------------------------------------
[INFO] Building Pcap4J 1.4.1-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO] 
[INFO] --- maven-enforcer-plugin:1.0:enforce (enforce-maven) @ pcap4j ---
[INFO] 
[INFO] --- maven-javadoc-plugin:2.9:aggregate-jar (aggregate-jar) @ pcap4j ---
[INFO] 
Loading source files for package org.pcap4j...
Loading source files for package org.pcap4j.core...
Loading source files for package org.pcap4j.packet...
Loading source files for package org.pcap4j.packet.constant...
Loading source files for package org.pcap4j.packet.factory...
Loading source files for package org.pcap4j.packet.namednumber...
Loading source files for package org.pcap4j.util...
Loading source files for package org.pcap4j.sample...
Constructing Javadoc information...
Standard Doclet version 1.7.0_80
Building tree for all the packages and classes...
Generating /root/IdeaProjects/pcap4j/target/apidocs/org/pcap4j/Pcap4jPropertiesLoader.html...
<<skipped other "Generating">>
Generating /root/IdeaProjects/pcap4j/target/apidocs/help-doc.html...
2 warnings
[WARNING] Javadoc Warnings
[WARNING] /root/IdeaProjects/pcap4j/pcap4j-core/src/main/java/org/pcap4j/packet/factory/PacketFactory.java:42: warning - Tag @link: can't find newInstance(byte[], NamedNumber) in org.pcap4j.packet.factory.PacketFactory
[WARNING] /root/IdeaProjects/pcap4j/pcap4j-core/src/main/java/org/pcap4j/packet/factory/PacketFactory.java:49: warning - Tag @link: can't find newInstance(byte[]) in org.pcap4j.packet.factory.PacketFactory
[INFO] Building jar: /root/IdeaProjects/pcap4j/target/pcap4j-1.4.1-SNAPSHOT-javadoc.jar
[INFO] 
[INFO] --- maven-install-plugin:2.3.1:install (default-install) @ pcap4j ---
[INFO] Installing /root/IdeaProjects/pcap4j/pom.xml to /root/.m2/repository/org/pcap4j/pcap4j/1.4.1-SNAPSHOT/pcap4j-1.4.1-SNAPSHOT.pom
[INFO] Installing /root/IdeaProjects/pcap4j/target/pcap4j-1.4.1-SNAPSHOT-javadoc.jar to /root/.m2/repository/org/pcap4j/pcap4j/1.4.1-SNAPSHOT/pcap4j-1.4.1-SNAPSHOT-javadoc.jar
[INFO]                                                                         
[INFO] ------------------------------------------------------------------------
[INFO] Building Pcap4J Core 1.4.1-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO] 
[INFO] --- maven-enforcer-plugin:1.0:enforce (enforce-maven) @ pcap4j-core ---
[INFO] 
[INFO] --- maven-resources-plugin:2.6:resources (default-resources) @ pcap4j-core ---
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] Copying 2 resources
[INFO] 
[INFO] --- maven-compiler-plugin:3.1:compile (default-compile) @ pcap4j-core ---
[INFO] Changes detected - recompiling the module!
[INFO] Compiling 191 source files to /root/IdeaProjects/pcap4j/pcap4j-core/target/classes
[INFO] 
[INFO] --- maven-resources-plugin:2.6:testResources (default-testResources) @ pcap4j-core ---
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] Copying 1 resource
[INFO] 
[INFO] --- maven-compiler-plugin:3.1:testCompile (default-testCompile) @ pcap4j-core ---
[INFO] Nothing to compile - all classes are up to date
[INFO] 
[INFO] --- maven-surefire-plugin:2.15:test (default-test) @ pcap4j-core ---
[INFO] Surefire report directory: /root/IdeaProjects/pcap4j/pcap4j-core/target/surefire-reports

-------------------------------------------------------
 T E S T S
-------------------------------------------------------
Running org.pcap4j.core.PcapHandleTest
14:03:51,341 |-INFO in ch.qos.logback.classic.LoggerContext[default] - Could NOT find resource [logback.groovy]
14:03:51,341 |-INFO in ch.qos.logback.classic.LoggerContext[default] - Found resource [logback-test.xml] at [file:/root/IdeaProjects/pcap4j/pcap4j-core/target/test-classes/logback-test.xml]
14:03:51,414 |-INFO in ch.qos.logback.classic.joran.action.ConfigurationAction - debug attribute not set
14:03:51,417 |-INFO in ch.qos.logback.core.joran.action.StatusListenerAction - Adding status listener of type [ch.qos.logback.core.status.OnConsoleStatusListener]
14:03:51,434 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - About to instantiate appender of type [ch.qos.logback.core.ConsoleAppender]
14:03:51,438 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - Naming appender as [CONSOLE]
14:03:51,471 |-INFO in ch.qos.logback.core.joran.action.NestedComplexPropertyIA - Assuming default type [ch.qos.logback.classic.encoder.PatternLayoutEncoder] for [encoder] property
14:03:51,524 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - About to instantiate appender of type [ch.qos.logback.core.FileAppender]
14:03:51,526 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - Naming appender as [FILE]
14:03:51,533 |-INFO in ch.qos.logback.core.joran.action.NestedComplexPropertyIA - Assuming default type [ch.qos.logback.classic.encoder.PatternLayoutEncoder] for [encoder] property
14:03:51,535 |-INFO in ch.qos.logback.core.FileAppender[FILE] - File property is set to [target/test/test.log]
14:03:51,536 |-INFO in ch.qos.logback.classic.joran.action.LoggerAction - Setting level of logger [org.pcap4j.core] to DEBUG
14:03:51,537 |-INFO in ch.qos.logback.classic.joran.action.LoggerAction - Setting additivity of logger [org.pcap4j.core] to true
14:03:51,537 |-INFO in ch.qos.logback.core.joran.action.AppenderRefAction - Attaching appender named [CONSOLE] to Logger[org.pcap4j.core]
14:03:51,538 |-INFO in ch.qos.logback.classic.joran.action.RootLoggerAction - Setting level of ROOT logger to DEBUG
14:03:51,538 |-INFO in ch.qos.logback.core.joran.action.AppenderRefAction - Attaching appender named [FILE] to Logger[ROOT]
14:03:51,540 |-INFO in ch.qos.logback.classic.joran.JoranConfigurator@736afade - Registering current configuration as safe fallback point
Tests run: 3, Failures: 0, Errors: 3, Skipped: 0, Time elapsed: 0.859 sec <<< FAILURE! - in org.pcap4j.core.PcapHandleTest
testGetStats(org.pcap4j.core.PcapHandleTest)  Time elapsed: 0.29 sec  <<< ERROR!
java.lang.NullPointerException: null
    at org.pcap4j.core.PcapNetworkInterface.<init>(PcapNetworkInterface.java:55)
    at org.pcap4j.core.PcapNetworkInterface.newInstance(PcapNetworkInterface.java:115)
    at org.pcap4j.core.Pcaps.findAllDevs(Pcaps.java:84)
    at org.pcap4j.core.PcapHandleTest.setUp(PcapHandleTest.java:34)

testListDatalinks(org.pcap4j.core.PcapHandleTest)  Time elapsed: 0.139 sec  <<< ERROR!
java.lang.NullPointerException: null
    at org.pcap4j.core.PcapNetworkInterface.<init>(PcapNetworkInterface.java:55)
    at org.pcap4j.core.PcapNetworkInterface.newInstance(PcapNetworkInterface.java:115)
    at org.pcap4j.core.Pcaps.findAllDevs(Pcaps.java:84)
    at org.pcap4j.core.PcapHandleTest.setUp(PcapHandleTest.java:34)

testSetDlt(org.pcap4j.core.PcapHandleTest)  Time elapsed: 0.141 sec  <<< ERROR!
java.lang.NullPointerException: null
    at org.pcap4j.core.PcapNetworkInterface.<init>(PcapNetworkInterface.java:55)
    at org.pcap4j.core.PcapNetworkInterface.newInstance(PcapNetworkInterface.java:115)
    at org.pcap4j.core.Pcaps.findAllDevs(Pcaps.java:84)
    at org.pcap4j.core.PcapHandleTest.setUp(PcapHandleTest.java:34)

Running org.pcap4j.core.PcapDumperTest
14:03:52.139 [main] DEBUG org.pcap4j.core.PcapDumper - Dumping a packet: [Ethernet Header (14 bytes)]
  Destination address: ff:ff:ff:ff:ff:ff
  Source address: fe:00:00:00:00:01
  Type: 0x0806 (ARP)
[ARP Header (28 bytes)]
  Hardware type: 1 (Ethernet (10Mb))
  Protocol type: 0x0800 (IPv4)
  Hardware address length: 6 [bytes]
  Protocol address length: 4 [bytes]
  Operation: 1 (REQUEST)
  Source hardware address: fe:00:00:00:00:01
  Source protocol address: /192.0.2.1
  Destination hardware address: ff:ff:ff:ff:ff:ff
  Destination protocol address: /192.0.2.2
[Ethernet Pad (18 bytes)]
  Hex stream: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

14:03:52.146 [main] DEBUG org.pcap4j.core.PcapDumper - Dumped a packet: ff ff ff ff ff ff fe 00 00 00 00 01 08 06 00 01 08 00 06 04 00 01 fe 00 00 00 00 01 c0 00 02 01 ff ff ff ff ff ff c0 00 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
14:03:52.147 [main] INFO  org.pcap4j.core.PcapDumper - Closed.
14:03:52.147 [main] INFO  org.pcap4j.core.PcapHandle - Closed.
14:03:52.149 [main] INFO  org.pcap4j.core.PcapDumperTest - initialPosition: 24
14:03:52.149 [main] DEBUG org.pcap4j.core.PcapDumper - Dumping a packet: [Ethernet Header (14 bytes)]
  Destination address: ff:ff:ff:ff:ff:ff
  Source address: fe:00:00:00:00:01
  Type: 0x0806 (ARP)
[ARP Header (28 bytes)]
  Hardware type: 1 (Ethernet (10Mb))
  Protocol type: 0x0800 (IPv4)
  Hardware address length: 6 [bytes]
  Protocol address length: 4 [bytes]
  Operation: 1 (REQUEST)
  Source hardware address: fe:00:00:00:00:01
  Source protocol address: /192.0.2.1
  Destination hardware address: ff:ff:ff:ff:ff:ff
  Destination protocol address: /192.0.2.2
[Ethernet Pad (18 bytes)]
  Hex stream: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

14:03:52.156 [main] DEBUG org.pcap4j.core.PcapDumper - Dumped a packet: ff ff ff ff ff ff fe 00 00 00 00 01 08 06 00 01 08 00 06 04 00 01 fe 00 00 00 00 01 c0 00 02 01 ff ff ff ff ff ff c0 00 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
14:03:52.156 [main] INFO  org.pcap4j.core.PcapDumperTest - position: 100
14:03:52.157 [main] INFO  org.pcap4j.core.PcapDumper - Closed.
14:03:52.157 [main] INFO  org.pcap4j.core.PcapHandle - Closed.
Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.013 sec - in org.pcap4j.core.PcapDumperTest
Running org.pcap4j.core.PcapsTest
14:03:52.385 [main] INFO  org.pcap4j.core.PcapsTest - 湥び
14:03:52.393 [main] INFO  org.pcap4j.core.PcapsTest - 1 (Ethernet) name: EN10MB
14:03:52.395 [main] INFO  org.pcap4j.core.PcapsTest - 9 (PPP) name: PPP
14:03:52.396 [main] INFO  org.pcap4j.core.PcapsTest - 1 (Ethernet) descr: Ethernet
14:03:52.397 [main] INFO  org.pcap4j.core.PcapsTest - 9 (PPP) descr: PPP
14:03:52.398 [main] INFO  org.pcap4j.core.PcapsTest - err: Operation not permitted
14:03:52.399 [main] INFO  org.pcap4j.core.PcapsTest - ver: libpcap version 1.6.2
Tests run: 15, Failures: 0, Errors: 1, Skipped: 0, Time elapsed: 0.377 sec <<< FAILURE! - in org.pcap4j.core.PcapsTest
testFindAllDevs(org.pcap4j.core.PcapsTest)  Time elapsed: 0.14 sec  <<< ERROR!
java.lang.NullPointerException: null
    at org.pcap4j.core.PcapNetworkInterface.<init>(PcapNetworkInterface.java:55)
    at org.pcap4j.core.PcapNetworkInterface.newInstance(PcapNetworkInterface.java:115)
    at org.pcap4j.core.Pcaps.findAllDevs(Pcaps.java:84)
    at org.pcap4j.core.PcapsTest.testFindAllDevs(PcapsTest.java:38)

Running org.pcap4j.core.PcapNetworkInterfaceTest
Tests run: 1, Failures: 0, Errors: 1, Skipped: 0, Time elapsed: 0.141 sec <<< FAILURE! - in org.pcap4j.core.PcapNetworkInterfaceTest
testOpenLive(org.pcap4j.core.PcapNetworkInterfaceTest)  Time elapsed: 0.139 sec  <<< ERROR!
java.lang.NullPointerException: null
    at org.pcap4j.core.PcapNetworkInterface.<init>(PcapNetworkInterface.java:55)
    at org.pcap4j.core.PcapNetworkInterface.newInstance(PcapNetworkInterface.java:115)
    at org.pcap4j.core.Pcaps.findAllDevs(Pcaps.java:84)
    at org.pcap4j.core.PcapNetworkInterfaceTest.testOpenLive(PcapNetworkInterfaceTest.java:39)


Results :

Tests in error: 
  PcapHandleTest.setUp:34 » NullPointer
  PcapHandleTest.setUp:34 » NullPointer
  PcapHandleTest.setUp:34 » NullPointer
  PcapsTest.testFindAllDevs:38 » NullPointer
  PcapNetworkInterfaceTest.testOpenLive:39 » NullPointer

Tests run: 21, Failures: 0, Errors: 5, Skipped: 0

[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary:
[INFO] 
[INFO] Pcap4J ............................................ SUCCESS [12.034s]
[INFO] Pcap4J Core ....................................... FAILURE [7.915s]
[INFO] Pcap4J Packet Test ................................ SKIPPED
[INFO] Pcap4J Static Packet Factory ...................... SKIPPED
[INFO] Pcap4J Properties-Based Packet Factory ............ SKIPPED
[INFO] Pcap4J Sample ..................................... SKIPPED
[INFO] Pcap4J Distribution ............................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 20.422s
[INFO] Finished at: Tue Apr 21 14:03:52 MSK 2015
[INFO] Final Memory: 18M/309M
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:2.15:test (default-test) on project pcap4j-core: There are test failures.
[ERROR] 
[ERROR] Please refer to /root/IdeaProjects/pcap4j/pcap4j-core/target/surefire-reports for the individual test results.
[ERROR] -> [Help 1]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR] 
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR]   mvn <goals> -rf :pcap4j-core

I have tun0 interface, he is the cause of problem

# ifconfig 
enp2s0    Link encap:Ethernet  HWaddr 38:2C:62:4A:7F:11  
          inet addr:192.168.5.35  Bcast:192.168.255.255  Mask:255.255.0.0
          inet6 addr: fdc3:2c30:e480:0:3a2c:4faf:fe62:7f11/64 Scope:Global
          inet6 addr: fe80::3a2c:4aff:ef62:7f11/64 Scope:Link
          inet6 addr: fdc3:2c30:e408:0:3c82:6f64:abb1:9a71/64 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1492  Metric:1
          RX packets:304328 errors:0 dropped:0 overruns:0 frame:0
          TX packets:165721 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:381499233 (363.8 Mb)  TX bytes:12148624 (11.5 Mb)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:132121 errors:0 dropped:0 overruns:0 frame:0
          TX packets:132121 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:14190299 (13.5 Mb)  TX bytes:14190299 (13.5 Mb)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:172.16.20.20  P-t-P:1.1.1.1  Mask:255.255.255.255
          UP POINTOPOINT RUNNING  MTU:1284  Metric:1
          RX packets:3 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:328 (328.0 b)  TX bytes:226 (226.0 b)

I have found that changing PcapNetworkInterface.java from

for (
      pcap_addr pcapAddr = pif.addresses;
      pcapAddr != null;
      pcapAddr = pcapAddr.next
    ) {

    for (
      pcap_addr pcapAddr = pif.addresses;
      (pcapAddr != null) && (pcapAddr.addr != null);
      pcapAddr = pcapAddr.next
    ) {

solves the problem and build goes fine.

bug

opened by mclaudt 13

IndexOutOfBounds in ByteArrays.calcChecksum

I'm trying to port some code from C to java which is building packets. I was having trouble getting the checksum for udp packets to match up, so after building the packet with the packet builder, I zeroed out bytes 26 and 27, then called short ck = ByteArrays.calcChecksum(retval);, which throws an exception. It almost appears that it's expecting a packet to be a length of % 2, which I don't believe is a requirement. I'm using 1.3.0. Any ideas? BTW, thanks for the awesome software. If I make some money with my project, I will look into helping support the project.

java.lang.ArrayIndexOutOfBoundsException: arr.length: 53, offset: 52, len: 2 at org.pcap4j.util.ByteArrays.validateBounds(ByteArrays.java:796) ~[pcap4j-core-1.3.0.jar:?] at org.pcap4j.util.ByteArrays.getShort(ByteArrays.java:125) ~[pcap4j-core-1.3.0.jar:?] at org.pcap4j.util.ByteArrays.getShort(ByteArrays.java:114) ~[pcap4j-core-1.3.0.jar:?] at org.pcap4j.util.ByteArrays.calcChecksum(ByteArrays.java:669) ~[pcap4j-core-1.3.0.jar:?]
bug

opened by bkrahmer 11
How to run in sudo(root) mode?

Hi, Kaitoy. I'm creating something with your library and need to debug it. So, it is running in Netbeans. But for example your function NifSelector().selectNetworkInterface(); needed to be run in sudo(root) mode. How to run this example in Netbeans in root mode on linux platform?
question

opened by koolmano 10
How to set packet to a given length except to call EthernetPacket.pad()

Hi Kaitoy,

I recreate this issue again, the original one is closed at https://github.com/kaitoy/pcap4j/issues/167.

So go ahead and say, there are two different use cases for how to make the packet length to a fixed number between our ideas.

for example, if we need a 100 bytes length packet consists of Ethernet/Ipv4/Icmpv4,

In your opion, it can be: |<---14 bytes--->|<------20 bytes---------|<---------12 bytes --------->|<------------54 bytes-------->| |-----Ethernet---- |--------- Ipv4----------- |--icmpv4 InformationReply--|----------extra bytes----------| |-------------------|-----------------------ipv4.total_length = 32-----------|-------------ether.pad---------|

My opion is: |<---14 bytes--->|<------20 bytes---------|<---------12 bytes --------->|<------------54 bytes-------->| |-----Ethernet---- |--------- Ipv4----------- |--icmpv4 InformationReply--|----------extra bytes----------| |-------------------|--------------------------------ipv4.total_length = 86-----------------------------------|

I think above both are rational, the different is only how we treat the extra bytes, as part in ipv4's payload, or as ethernet's pad.

Now my work is blocked by the second case, I'm using pcap4j to replace some commercial product, like Ixia traffic generator, which can build the packet as user wish, the problem is Ixia works as the second case above to set the packet to a fixed length.

I'm seeking a way in pcap4j to solve the second case, so may need you idea about it.

Thanks in advanced.
question

opened by leomaatEric 10
When I set the setcap cap_net_raw,cap_net_admin=eip /path/to/java; the java can not run anymore, it report the error below

Initially, I would like to run java -cp pcap4j-core.jar:pcap4j-packetfactory-static.jar:pcap4j-sample.jar:jna-3.5.2.jar:slf4j-api-1.6.4.jar org.pcap4j.sample.SendArpRequest 192.168.209.1; It required to choose with the following instruction: NIF[0]: enp9s0 : link layer address:
: address: / : address: / : address: / NIF[1]: any : description: Pseudo-device that captures on all interfaces NIF[2]: lo : link layer address: 00:00:00:00:00:00 : address: /127.0.0.1 : address: /0:0:0:0:0:0:0:1 NIF[3]: wlp3s0 : link layer address:
NIF[4]: docker0 : link layer address:
: address: /

*_Some exception prompted after choosing the first device._*

However, it said I did not have permission withe the exception below: Exception in thread "main" org.pcap4j.core.PcapNativeException: enp9s0: You don't have permission to capture on that device (socket: Operation not permitted) at org.pcap4j.core.PcapNetworkInterface.openLive(PcapNetworkInterface.java:258) at org.pcap4j.sample.SendArpRequest.main(SendArpRequest.java:74)

So I set the setcap cap_net_raw,cap_net_admin=eip /path/to/java in my Ubuntu. Then the java can not run anymore, it report the error below: java: error while loading shared libraries: libjli.so: cannot open shared object file: No such file or directory

How to fix it?
question

opened by xiaoleihuang 10
Memory leak while reading packets from pcap file?
Hi,

I'm using pcap4j for reading large pcap files. I just dump the rawdata to Standard stdout.

At around 400 000 - 450 000 packets the program start to get slow. Then later on I get an OOM (heap space).

Is there any option to discard the packets as I read them ? I have the impression that the packets might be accumulated in PcapHandle ?

Here's the code (tested with 1.3.1-SNAPSHOT and 1.3.0):

PcapHandle h = Pcaps.openOffline(pcapFilename); Packet p = null; long nbPackets = 0; while(true) { p = h.getNextPacket(); if (p == null) { break; } UdpPacket up = p.get(UdpPacket.class); if (up != null) { System.out.println(nbPackets++ + " " + p.toString()); } }
discussion
opened by codingtony 10
Status code of a request

Hi,kaitoy. thanks for your pacap4j. It work good for me. But how can I get the status code of a specific request, I mean the response code such as 200,304.... Please give some advice,thanks!

opened by Taoode 9

About the getNextPacketEx problem under linux

I installed suse linux 15 sp1 in a virtual machine, pcap4j version is 1.8.2, when using getNextPacketEx, it will cause the thread to be stuck and not catch any exception, after testing, I found that assuming detecting 5 IP addresses, it will be stuck when looping to the sixth time, assuming detecting 1 IP address, it will be stuck when looping to the second time. After testing, we found that if we probe 5 IP addresses, the thread will get stuck when the loop reaches the sixth time, and if we probe 1 IP address, it will get stuck when the loop reaches the second time. The code is as follows.

import com.itss.spring.domain.ipc.IpcProbeserverNif; import com.itss.spring.web.SpringContextUtil; import com.itss.spring.web.component.pcap.PcapHelper; import com.itss.spring.web.component.pcap.entity.HostScanInfo; import com.itss.spring.web.component.pcap.entity.UltraScanInfo; import com.ursa.acf.util.StringUtils; import org.pcap4j.core.*; import org.pcap4j.packet.IpV4Packet; import org.pcap4j.packet.Packet; import org.slf4j.Logger; import org.slf4j.LoggerFactory;

import java.io.EOFException; import java.net.Inet4Address; import java.util.HashMap; import java.util.LinkedHashMap; import java.util.List; import java.util.Map; import java.util.concurrent.*;

public class PcapPacketListener { private static final Logger logger = LoggerFactory.getLogger(PcapPacketListener.class);

private Object lock;

public PcapPacketListener(Object lock) {
    this.lock = lock;
}

public  Map<HostScanInfo, Packet> lisenerForIpScan(UltraScanInfo ultraScanInfo, PcapNetworkInterface nif) throws Exception {
    PcapHelper pcapHelper = (PcapHelper) (SpringContextUtil.getBean(PcapHelper.class));

    
    LinkedHashMap<String, HostScanInfo> incompleteHosts = ultraScanInfo.getIncompleteHosts();
    
    Map<HostScanInfo, Packet> packetTempMap = new HashMap<>();


    String receiveMac = "";
    List<IpcProbeserverNif> receiveNifs = ultraScanInfo.getReceiveNifs();
    for (IpcProbeserverNif receiveNif : receiveNifs) {
        if (receiveNif.getName().equals(nif.getName())) {
            receiveMac = receiveNif.getLinklayeraddress();
            break;
        }
    }
 

    
    PcapHandle.Builder handleBuilder = new PcapHandle.Builder(nif.getName())
            .snaplen(65536)
            .promiscuousMode(PcapNetworkInterface.PromiscuousMode.PROMISCUOUS)
            .timeoutMillis(30)
            .bufferSize(1024 * 1024 * 10);
    
    PcapHandle handler = handleBuilder.build();

    String filter = pcapHelper.createPcapFilter(ultraScanInfo);
    if (!StringUtils.trim(filter).equals("")) {
        handler.setFilter(filter, BpfProgram.BpfCompileMode.OPTIMIZE);
    }

    ExecutorService pool = Executors.newSingleThreadExecutor();
    CloserTask t = new CloserTask(lock);
    Future<Boolean> f = pool.submit(t);


    try {
        int count = 0;
        
        while (!f.isDone()) {
            count++;
         
            logger.error("count:"+count);
            Packet packet =null;
            try {
                packet = handler.getNextPacketEx();
            }catch (PcapNativeException pcapNativeException){
                logger.error("pcapNativeException",pcapNativeException);
            }catch (EOFException eofException){
                logger.error("eofException",eofException);
            }catch (TimeoutException timeoutException){
                logger.error("timeoutException",timeoutException);
            }catch (NotOpenException notOpenException){
                logger.error("notOpenException",notOpenException);
            }
            logger.error("packet is null:"+(packet == null));

            if (packet == null) {
                continue;
            }

            IpV4Packet ipPacket = packet.get(IpV4Packet.class);

            logger.error("ipPacket is null:"+(ipPacket == null));

            if (ipPacket == null) {
                continue;
            }

            Inet4Address srcAddr = ipPacket.getHeader().getSrcAddr();
            String srcAddrIp = srcAddr.getHostAddress();
            logger.error("srcAddrIp:"+srcAddrIp);

            logger.error("incompleteHosts.containsKey(srcAddrIp)"+(incompleteHosts.containsKey(srcAddrIp)));
            if (incompleteHosts.containsKey(srcAddrIp)) {
                HostScanInfo hostScanInfo = new HostScanInfo();
                hostScanInfo.setIp(srcAddrIp);
                hostScanInfo.setReceiveTime(handler.getTimestamp());
                hostScanInfo.setReceiveNifMac(receiveMac);
                packetTempMap.put(hostScanInfo, packet);
            }
            Thread.sleep(10);
        }
    } catch (Exception e) {
        logger.error("循环监听回包出错！", e);
        throw e;
    } finally {
        logger.error("finally start............");
        pool.shutdownNow();
        handler.close();
    }


    // 处理收包
    // if (!packetTempMap.isEmpty()) {
    //     pcapHelper.dealReceivePacket(packetTempMap, ultraScanInfo, handler);
    // }
    // ultraScanInfo.setScanEndTime(new Date());

    return packetTempMap;
}

/**
 * 计时器
 */
private class CloserTask implements Callable<Boolean> {
    private Object lock;

    public CloserTask(Object lock) {
        this.lock = lock;
    }

    @Override
    public Boolean call() throws Exception {
        synchronized (lock) {
            lock.wait();
            return true;
        }
    }
}

}

opened by gitlei0507 0

Unknow tcp option doesnt support reserved options

Hi The problem here is if some tcp option number is larger than 128 and then the code will throw an error: (version 1.7.3) an example code:

byte [] bs = Base64.getDecoder().decode("dCWKAicArB9r+H5DCABFAACotN1AAEAG40i3gzI+mlMeFUQISte4gAAARAgAAIAYPjqUzAAA7rULDDC7TXc6A8JA6wKfafNuajj1xuQiQMpvcrwWduPX4QCITE3XjFyr5oAKjnbT6sP3XBVYfGpNonXfd2EUuAwNHlqqSirSaP0/oMEvO7vHI+cRS0QYkb0/k86JRLSsw7NlhBiFDNeTJjWAEKqrjq3r+ScPjm6UryNGvT3lbm4=");
EthernetPacket p = EthernetPacket.newPacket(bs, 0, bs.length);
System.out.println(p);

java.lang.ArrayIndexOutOfBoundsException: arr.length: 182, offset: 56, len: -77, arr: 74258a022700ac1f6bf87e430800450000a8b4dd40004006e348b783323e9a531e1544084ad7b88000004408000080183e3a94cc0000eeb50b0c30bb4d773a03c240eb029f69f36e6a38f5c6e42240ca6f72bc1676e3d7e100884c4dd78c5cabe6800a8e76d3eac3f75c15587c6a4da275df776114b80c0d1e5aaa4a2ad268fd3fa0c12f3bbbc723e7114b441891bd3f93ce8944b4acc3b3658418850cd79326358010aaab8eadebf9270f8e6e94af2346bd3de56e6e
	at org.pcap4j.util.ByteArrays.validateBounds(ByteArrays.java:1078) ~[pcap4j-core-1.7.3.jar:?]
	at org.pcap4j.util.ByteArrays.getSubArray(ByteArrays.java:820) ~[pcap4j-core-1.7.3.jar:?]
	at org.pcap4j.packet.UnknownTcpOption.<init>(UnknownTcpOption.java:77) ~[pcap4j-core-1.7.3.jar:?]
	at org.pcap4j.packet.UnknownTcpOption.newInstance(UnknownTcpOption.java:45) ~[pcap4j-core-1.7.3.jar:?]
	at org.pcap4j.packet.factory.StaticTcpOptionFactory.newInstance(StaticTcpOptionFactory.java:174) ~[pcap4j-packetfactory-static-1.7.3.jar:?]
	at org.pcap4j.packet.factory.StaticTcpOptionFactory.newInstance(StaticTcpOptionFactory.java:168) ~[pcap4j-packetfactory-static-1.7.3.jar:?]
	at org.pcap4j.packet.factory.StaticTcpOptionFactory.newInstance(StaticTcpOptionFactory.java:29) ~[pcap4j-packetfactory-static-1.7.3.jar:?]
	at org.pcap4j.packet.TcpPacket$TcpHeader.<init>(TcpPacket.java:675) [pcap4j-core-1.7.3.jar:?]
	at org.pcap4j.packet.TcpPacket$TcpHeader.<init>(TcpPacket.java:482) [pcap4j-core-1.7.3.jar:?]
	at org.pcap4j.packet.TcpPacket.<init>(TcpPacket.java:64) [pcap4j-core-1.7.3.jar:?]
	at org.pcap4j.packet.TcpPacket.newPacket(TcpPacket.java:60) [pcap4j-core-1.7.3.jar:?]
	at org.pcap4j.packet.factory.StaticIpNumberPacketFactory$4.newInstance(StaticIpNumberPacketFactory.java:83) [pcap4j-packetfactory-static-1.7.3.jar:?]
	at org.pcap4j.packet.factory.AbstractStaticPacketFactory.newInstance(AbstractStaticPacketFactory.java:46) [pcap4j-packetfactory-static-1.7.3.jar:?]
	at org.pcap4j.packet.factory.AbstractStaticPacketFactory.newInstance(AbstractStaticPacketFactory.java:23) [pcap4j-packetfactory-static-1.7.3.jar:?]
	at org.pcap4j.packet.IpV4Packet.<init>(IpV4Packet.java:94) [pcap4j-core-1.7.3.jar:?]
	at org.pcap4j.packet.IpV4Packet.newPacket(IpV4Packet.java:61) [pcap4j-core-1.7.3.jar:?]
	at org.pcap4j.packet.factory.StaticEtherTypePacketFactory$1.newInstance(StaticEtherTypePacketFactory.java:37) [pcap4j-packetfactory-static-1.7.3.jar:?]
	at org.pcap4j.packet.factory.StaticEtherTypePacketFactory.newInstance(StaticEtherTypePacketFactory.java:111) [pcap4j-packetfactory-static-1.7.3.jar:?]
	at org.pcap4j.packet.factory.StaticEtherTypePacketFactory.newInstance(StaticEtherTypePacketFactory.java:24) [pcap4j-packetfactory-static-1.7.3.jar:?]
	at org.pcap4j.packet.EthernetPacket.<init>(EthernetPacket.java:102) [pcap4j-core-1.7.3.jar:?]
	at org.pcap4j.packet.EthernetPacket.newPacket(EthernetPacket.java:61) [pcap4j-core-1.7.3.jar:?]

in this url https://hpd.gasmi.net/, and paste above content, it will shows:

74 25 8A 02 27 00 AC 1F 6B F8 7E 43 08 00 45 00 00 A8 B4 DD 40 00 40 06 E3 48 B7 83 32 3E 9A 53 1E 15 44 08 4A D7 B8 80 00 00 44 08 00 00 80 18 3E 3A 94 CC 00 00 EE B5 0B 0C 30 BB 4D 77 3A 03 C2 40 EB 02 9F 69 F3 6E 6A 38 F5 C6 E4 22 40 CA 6F 72 BC 16 76 E3 D7 E1 00 88 4C 4D D7 8C 5C AB E6 80 0A 8E 76 D3 EA C3 F7 5C 15 58 7C 6A 4D A2 75 DF 77 61 14 B8 0C 0D 1E 5A AA 4A 2A D2 68 FD 3F A0 C1 2F 3B BB C7 23 E7 11 4B 44 18 91 BD 3F 93 CE 89 44 B4 AC C3 B3 65 84 18 85 0C D7 93 26 35 80 10 AA AB 8E AD EB F9 27 0F 8E 6E 94 AF 23 46 BD 3D E5 6E 6E

Root cause of this ticket is the length variable in TcpOption is byte while in java, byte can only represent -128-127. This will cause an exception if the length is larger than this. in my case it's 181 bytes.

and I will fix this.

opened by gaoxingliang 0

How can I get mac address？

if I don't know the mac address,how can i encapsulate packet. Arp request is designed for getting dst mac address,sending arp request is the network interface's responsibility,how can i make network interface to do this work for me？

opened by SpicyChicken1010 1