PCAP-NG-Parser is a stream-based module to decode, print and analyze network traffic packets. With this module, you can read from an existing .pcapng file or connect it to an active stream. PCAP-NG-Parser is currently in active development. At this time, it supports only ethernet protocols from the output of TCPDump v. 4.9.2.
Excerpt from: https://github.com/node-pcap/node_pcap
This module is available through the npm registry.
$ npm install pcap-ng-parser
Via .pcapng File
Here is a quick example of how to log out packets to the console from a valid .pcapng file named
const PCAPNGParser =const pcapNgParser =const myFileStream =myFileStream
In the example above, we create a new Readable stream from our file and pipe the instance
pcapNgParser which will read our packet data on the
You can also pipe from TCPDump using
process.stdin for a command line interaction.
const PCAPNGParser =const pcapNgParser =processstdin
$ sudo tcpdump -w - | node exampleAbove.js
Note that in order to utilize tcpdump you must be a superuser. Refer to tcpdump documentation for details.
Additional examples can be found in the examples directory.
PCAPNGParser is an extension of the stream.Transform class. The PCAPNGParser class has a modified
data event and a custom
interface event. For any additional details for how to interface with Transform streams, refer to the Node.js stream documentation.
Array| List of all interfaces that the instance of PCAPNGParser has interacted with.
Object| The parsed packet data. The
dataevent is emitted whenever the PCAPNGParser stream is ready to relinquish ownership of packet data to a consumer.
Example of a
interfaceId: 0timestampHigh: 355515timestampLow: 1834438968data: <Buffer >
Description of parsedPacket Properties
integer| The order in which PCAPNGParser has interacted with the interface. Interface can be accessed by accessing the
interfacesproperty of the instance of the PCAPNGParser class.
integer| The upper 32 bits of the 64-bit timestamp integer. Refer to the PCAPNG documentation on this matter for more details.
integer| The lower 32 bits of the 64-bit timestamp integer. Refer to the PCAPNG documentation on this matter for more details.
buffer| A buffer with the data of the current packet.
object| Interface Data. The
interfaceevent is emitted whenever the PCAPNGParser stream has encountered a new interface type not encountered yet.
Example of an
linkType: 1snapLen: 262144name: 'en0'
Description of interfaceInfo Properties
integer| The linktype of the current interface. Refer to the TCPDump Link-Layer header documentation for more details.
integer| An estimate for the length of the packets coming from the interface.
string| The name of the interface.
Refer to the the Contribution Guide for details on how to contribute.
This module is covered under the BSD-3 Open Software License. Review the License Documention for more information.