A lightweight and efficient packet sniffer written in C++ that analyzes PCAP files. This project uses libpcap for low-level packet capturing and parsing, and demonstrates modern C++ practices along with command-line argument parsing.
-
Offline Analysis: Read and analyze packets from PCAP files.
-
Detailed Packet Parsing: Extract and display various protocol fields such as:
- MAC addresses (source and destination)
- EtherType (e.g., IPv4, ARP)
- IP header fields (version, header length, time-to-live, etc.)
- Protocol (TCP, UDP, ICMP, etc.)
- Ports and IP addresses
- Data/payload
-
Filtering Options: Command-line options allow you to filter captured traffic by:
- Source or destination IP (
--src <ip>,--dst <ip>) - Port number (
--port <number>)
- Source or destination IP (
- C++ Compiler: Supporting C++17 (e.g. GCC 7+, Clang 7+)
- CMake: Version 3.10 or later
- libpcap: Development headers and library (often available via package manager)
- Optional: GoogleTest/GoogleMock for unit testing.
-
Clone the Repository:
git clone https://github.com/without-eyes/PacketSniffer.git cd PacketSniffer -
Configure the Build with CMake:
mkdir build && cd build cmake ..
-
Build the Project:
make
-
Run the Program:
./PacketSniffer -f /path/to/file.pcap
-
File Mode:
-f, --file <filename>Reads packets from the specified PCAP file.
-
Filtering Options:
--src <ip>: Show only packets from the source IP.--dst <ip>: Show only packets to the destination IP.--port <number>: Filter packets by port number (source or destination).
Run ./PacketSniffer -h or --help for detailed usage information.
-
src/: Contains the core code including the packet parsing. The main class
PcapFileReaderhandles loading PCAP files, extracting packet details, and printing information. -
include/: Header files for the project classes and utilities.
-
tests/: Unit tests written using GoogleTest to validate parsing and filtering functionalities.
-
CMakeLists.txt: The CMake build script, which includes options for building both the main application and tests.
This project is licensed under the MIT License – see the LICENSE file for details.