{"id":13590103,"url":"https://github.com/dotpcap/sharppcap","last_synced_at":"2025-05-15T12:07:04.946Z","repository":{"id":32778263,"uuid":"36370093","full_name":"dotpcap/sharppcap","owner":"dotpcap","description":"Official repository - Fully managed, cross platform (Windows, Mac, Linux) .NET library for capturing packets","archived":false,"fork":false,"pushed_at":"2025-04-22T12:29:08.000Z","size":3499,"stargazers_count":1418,"open_issues_count":26,"forks_count":274,"subscribers_count":60,"default_branch":"master","last_synced_at":"2025-05-11T02:18:44.188Z","etag":null,"topics":["analysis","c-sharp","capture-packets","capturing-packets","cross-platform","linux","macos","network-monitoring","network-programming","npcap","packet","packets","sharppcap","windivert","windows"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dotpcap.png","metadata":{"files":{"readme":"README.md","changelog":"History.md","contributing":null,"funding":null,"license":"LICENSES/MIT.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2015-05-27T13:53:52.000Z","updated_at":"2025-05-09T10:02:09.000Z","dependencies_parsed_at":"2023-10-15T14:26:32.258Z","dependency_job_id":"f9661ac4-c6b5-4fa2-98b5-0b95dea957c0","html_url":"https://github.com/dotpcap/sharppcap","commit_stats":{"total_commits":1011,"total_committers":34,"mean_commits":"29.735294117647058","dds":0.4451038575667656,"last_synced_commit":"d09d8758b415f34641516b5e83caf47165014ba1"},"previous_names":["chmorgan/sharppcap"],"tags_count":43,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dotpcap%2Fsharppcap","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dotpcap%2Fsharppcap/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dotpcap%2Fsharppcap/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dotpcap%2Fsharppcap/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dotpcap","download_url":"https://codeload.github.com/dotpcap/sharppcap/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254104402,"owners_count":22015464,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["analysis","c-sharp","capture-packets","capturing-packets","cross-platform","linux","macos","network-monitoring","network-programming","npcap","packet","packets","sharppcap","windivert","windows"],"created_at":"2024-08-01T16:00:39.288Z","updated_at":"2025-05-15T12:06:59.924Z","avatar_url":"https://github.com/dotpcap.png","language":"C#","readme":"[![](https://img.shields.io/nuget/v/SharpPcap.svg?label=NuGet\u0026logo=nuget)](https://www.nuget.org/packages/SharpPcap/)\n[![.NET Core](https://github.com/dotpcap/sharppcap/actions/workflows/dotnet-core.yml/badge.svg)](https://github.com/dotpcap/sharppcap/actions/workflows/dotnet-core.yml)\n[![](https://img.shields.io/appveyor/ci/chmorgan/sharppcap/master.svg?label=AppVeyor\u0026logo=appveyor)](https://ci.appveyor.com/project/chmorgan/sharppcap/branch/master)\n[![](https://dev.azure.com/dotpcap/dotpcap/_apis/build/status/dotpcap.sharppcap)](https://dev.azure.com/dotpcap/dotpcap/_build/latest?definitionId=2\u0026branchName=master)\n[![](https://circleci.com/gh/dotpcap/sharppcap/tree/master.svg?style=svg)](https://circleci.com/gh/dotpcap/sharppcap/tree/master)\n[![](https://codecov.io/gh/dotpcap/sharppcap/branch/master/graph/badge.svg?token=znqv9q5lVA)](https://codecov.io/gh/dotpcap/sharppcap)\n[![](https://badges.gitter.im/SharpPcap/community.svg)](https://gitter.im/SharpPcap/community)\n\n# sharppcap\nFully managed, cross platform (Windows, Mac, Linux) .NET library for capturing packets from live and file based devices\n\nThe official SharpPcap repository.\n\n# Table of Contents\n1. [Features](#features)\n2. [Examples](#examples)\n   - [Listing Devices](#listing-devices)\n   - [Capturing Packets](#capturing-packets)\n   - [Reading from a Capture File](#reading-from-a-capture-file)\n   - [Writing to a Capture File](#writing-to-a-capture-file)\n3. [CI Support](#ci-support)\n4. [Releases](#releases)\n5. [Platform Specific Notes](#platform-specific-notes)\n6. [Migration from 5.x to 6.0](#migration-from-5x-to-60)\n\n\u003ca name=\"features\"\u003e\u003c/a\u003e\n\n# Features\nFor packet dissection and creation, see [Packet.Net](https://github.com/chmorgan/packetnet).\n\n* On Linux, support for [libpcap](http://www.tcpdump.org/manpages/pcap.3pcap.html)\n\n* On Windows, support for:\n  * Npcap (formerly WinPcap) extensions, see [Npcap API guide](https://nmap.org/npcap/guide/npcap-devguide.html#npcap-api)\n  * WinDivert (https://www.reqrypt.org/windivert.html)\n\n* On all platforms:\n  * Live device lists\n  * Statistics\n  * Reading packets from Live Devices (actual network devices) and Offline Devices (Capture files)\n  * Support for [Berkeley Packet Filters](https://www.tcpdump.org/manpages/pcap-filter.7.html)\n  * Dumping packets to Pcap files.\n  * Pcap and pcap-ng format (when using libpcap \u003e=1.1.0 or npcap)\n  * ReadOnlySpan\u003c\u003e is used to avoid memory allocation and copying inside of SharpPcap and provide the best performance.\n    * Helper methods are provided to convert to object instances if it is desired to persist captured packets in memory.\n\n* NativeLibrary support\n  * Capture library resolution operates smoothly across Linux, OSX, and Windows\n  * Cleanly loads libpcap on Linux whether the distro has a symlink to libpcap.so or not.\n\n* .NET Core 3 and .NET Framework support\n\n\u003ca name=\"examples\"\u003e\u003c/a\u003e\n\n# Examples\n\nSee the [Examples](https://github.com/chmorgan/sharppcap/tree/master/Examples) folder for a range of full example projects using SharpPcap\n\n\u003ca name=\"listing-devices\"\u003e\u003c/a\u003e\n\n## Listing devices\n   ```cs\n   var devices = CaptureDeviceList.Instance;\n   foreach (var dev in devices)\n       Console.WriteLine(\"{0}\\n\", dev.ToString());\n   ```\n\n\u003ca name=\"capturing-packets\"\u003e\u003c/a\u003e\n\n## Capturing packets\n   ```cs\n   void Device_OnPacketArrival(object s, PacketCapture e)\n   {\n       Console.WriteLine(e.GetPacket());\n   }\n\n   using var device = LibPcapLiveDeviceList.Instance[0];\n   device.Open();\n   device.OnPacketArrival += Device_OnPacketArrival;\n   device.StartCapture();\n   ```\n\n\u003ca name=\"reading-from-a-capture-file\"\u003e\u003c/a\u003e\n\n## Reading from a capture file\n   ```cs\n   void Device_OnPacketArrival(object s, PacketCapture e)\n   {\n       Console.WriteLine(e.GetPacket());\n   }\n\n   using var device = new CaptureFileReaderDevice(\"filename.pcap\");\n   device.Open();\n   device.OnPacketArrival += Device_OnPacketArrival;\n   device.Capture();\n   ```\n\n\u003ca name=\"writing-to-a-capture-file\"\u003e\u003c/a\u003e\n\n## Writing to a capture file\n   ```cs\n   using var device = new CaptureFileWriterDevice(\"somefilename.pcap\", System.IO.FileMode.Open);\n   var bytes = new byte[] { 1, 2, 3, 4 };\n   device.Write(bytes);\n   ```\n\n\u003ca name=\"ci-support\"\u003e\u003c/a\u003e\n\n# CI support\nWe have support for a number of CI systems for a few reasons:\n\n* Diversity of CI systems in case one of them shuts down\n* Examples in case you'd like to customize SharpPcap and make use of one of these CI systems for internal builds. Note that we assume you are following the license for the library.\n\n\u003ca name=\"releases\"\u003e\u003c/a\u003e\n\n# Releases\nSharpPcap is released via nuget\n\n\u003ca name=\"platform-specific-notes\"\u003e\u003c/a\u003e\n\n# Platform specific notes\n* OSX (at least as of 11.1) lacks libpcap with pcap_open\n\n# Thanks\n\nSharpPcap is where it is today because of a number of developers who have provided improvements and fixes\nand users that have provided helpful feedback through issues and feature requests.\n\nWe are especially appreciative of a number of projects we build upon (as SharpPcap is a C# wrapper):\n\n* libpcap - thank you so much for releasing 1.10\n* npcap - for continuing packet capture support on Windows\n\n\u003ca name=\"migration-from-5x-to-60\"\u003e\u003c/a\u003e\n\n# Migration from 5.x to 6.0\n\nWe hope that you'll find the 6.x api to be cleaner and easier to use.\n\n6.0 brings a number of cleanups that have resulted in API breakage for 5.x users.\n\nTo aid with the migration from 5.x to 6.0 here is a list of some of the changes you'll have to make to your\nSharpPcap usage.\n\nThe examples are also a great resource as they show working examples using the latest API.\n\n* Packet data is returned via PacketCapture which makes use of ReadOnlySpan\u003c\u003e.\n  * Conversion from ReadOnlySpan\u003c\u003e to RawCapture is performed by PacketCapture.GetPacket().\n  * This avoids allocation of memory during packet capture.\n  * By avoiding memory allocation and memory copying, raw capture performance may be up to 30% faster.\n  * Span's are ideal for use cases where packets are being dumped to disk for later processing.\n* NativeLibrary is used for improved capture library resolution\n  * Improves library resolution situation on Linux distros where there is a libpcap.so.X.Y symlink but no libpcap.so symlink\n  * Support for Mono DllMap has been removed as Mono supports NativeLibrary. See https://www.mono-project.com/news/2020/08/24/native-loader-net5/\n* Devices are IDisposable\n  * Remove calls to Close()\n  * Switch 'var device = xxx;'to 'using device = xxx;'\n* Rename OpenFlags -\u003e DeviceModes\n* Open() methods have been collapsed into fewer methods with default variables.\n* DeviceMode has been replaced by DeviceModes as DeviceMode was not able to cover all of the combinations of ways you could open a device.\n* NpcapDevice -\u003e LibPcapLiveDevice\n  * If you are using NpcapDevice, you should consider using LibPcapLiveDevice. The latest versions of Npcap come with\nnewer versions of libpcap that provide almost all of the functionality of Npcap native APIs.\n  * The current gap here is statistics mode, currently only supported by Npcap.\n  * There has been talk of a statistics mode wrapper that would provide similar functionality, albeit without\nthe same level of efficiency as if it were done in the kernel or driver as on Windows, for libpcap systems.\n* WinPcap has been deprecated\n  * We recommend switching to LibPcapLiveDevice\n* Remote authentication\n  * If you are using RemoteAuthentication some functionality has been folded into this class and the api changed\nto remove usage of ICredentials and NetworkCredentials.\n","funding_links":[],"categories":["C# #","C#","C\\#"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdotpcap%2Fsharppcap","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdotpcap%2Fsharppcap","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdotpcap%2Fsharppcap/lists"}