{"id":33185664,"url":"https://github.com/giorgiopapini/netdump","last_synced_at":"2025-11-22T04:01:28.983Z","repository":{"id":259314370,"uuid":"861560818","full_name":"giorgiopapini/netdump","owner":"giorgiopapini","description":"A simple network packet analyzer using libpcap, supporting both real-time and offline analysis with ASCII visualization.","archived":false,"fork":false,"pushed_at":"2025-06-28T13:42:43.000Z","size":28951,"stargazers_count":20,"open_issues_count":1,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-06-28T14:36:37.836Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/giorgiopapini.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-09-23T06:12:58.000Z","updated_at":"2025-06-28T13:42:46.000Z","dependencies_parsed_at":"2024-10-24T10:04:33.184Z","dependency_job_id":"68ba3d75-d1b1-4711-8d33-99d5bd157602","html_url":"https://github.com/giorgiopapini/netdump","commit_stats":null,"previous_names":["giorgiopapini/netdump"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/giorgiopapini/netdump","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/giorgiopapini%2Fnetdump","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/giorgiopapini%2Fnetdump/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/giorgiopapini%2Fnetdump/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/giorgiopapini%2Fnetdump/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/giorgiopapini","download_url":"https://codeload.github.com/giorgiopapini/netdump/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/giorgiopapini%2Fnetdump/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":285731803,"owners_count":27222214,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-11-22T02:00:05.934Z","response_time":64,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-11-16T05:00:20.098Z","updated_at":"2025-11-22T04:01:28.977Z","avatar_url":"https://github.com/giorgiopapini.png","language":"C","funding_links":[],"categories":["\u003ca name=\"networking\"\u003e\u003c/a\u003eNetworking"],"sub_categories":[],"readme":"## What is netdump?\nBased on libpcap and completely built in C, netdump is a free and open-source network protocol analizer.\nnetdump is designed to cater to users with varying levels of expertise and backgrounds. It achieves this by providing an easy-to-use CLI tool, along with a straightforward netdump-devel package. This setup is ideal for users who need to analyze industry-specific protocols, those interested in building their own dissector implementations, and also for people who simply want to scan a network or a .pcap file.\n\nDisclaimer: netdump is entirely independent and unrelated to any other programs named \"netdump\" or similar.\n\n## Makefile configuration\nAt this time, support is limited to GNU Make only.\n\nCheck the default Makefile variable configuration using ```make show-config```.\nIf your system stores those files in different locations, you can run ```make install VARIABLE_NAME='/path/'```\n\nRemember that these commands might need to be run with elevated privileges.\n\n## Installation\nNetdump can be executed on Unix-like operating systems conforming to the POSIX standard. It can be installed manually using make, or installed by using a package manager (RPM on Fedora, CentOS and RHEL).\nYou can install netdump in several ways depending on your goal:\n\n1) Clone the repo and compile the program using ```make```.\n2) Clone the repo and install the program inside ```/usr/local/bin``` by running ```make install```.\n3) Install the program inside ```/usr/bin``` by using a package manager.\n\n## Running netdump\nThere are several methods to execute netdump based upon the installation process you chose:\n\n1) Execute ```./netdump``` if you just compiled the program using ```make```.\n2) Execute ```/usr/local/bin/netdump``` (or ```netdump```) if you installed the program using ```make install```.\n3) Execute ```netdump``` if you installed it using a package manager.\n\nSome features, such as real-time network scanning, require netdump to be run with elevated privileges.\n\n## Remove netdump\nYou can remove netdump from your system in several ways:\n\n1) Execute ```make remove``` if you previously installed netdump using ```make install```.\n2) Uninstall netdump using the package manager you used to install it.\n\nRemember that these commands might need to be run with elevated privileges.\n\n## Netdump commands\nThe general command format is this ```netdump \u003ccommand\u003e -\u003carg_1\u003e \u003cvalue_1\u003e ... -\u003carg_n\u003e \u003cvalue_n\u003e```.\nRun the ```help``` command from anywhere inside the CLI tool to get a small doc about every command and its supported arguments.\nStrings should be enclosed in \"\" to prevent netdump from misinterpreting uppercase letters, -, and other symbols.\n\n### ```analyze```\nThis command is used to scan incoming and outgoing network traffic for a selected device.\nThe following table lists the allowed arguments for this command.\n\n| Arg | Value | Description |\n|--------|------------|---------|\n| `-n` | int | Set a packet scanning limit |\n| `-filter` | str | Filter packets (based upon libpcap's filter function) |\n| `-dev` | str | Select an avaliable device for scanning network traffic |\n| `-e` | none | Show datalink layer protocol header |\n| `-nnet` | none | Don't show network layer protocol header |\n| `-t` | none | Show transport layer protocol header |\n| `-a` | none | Show application layer protocol header |\n| `-nprom` | none | Turn off libpcap promiscuos mode |\n| `-ntime` | none | Hide timestamp |\n| `-npname` | none | Hide protocol name in the output |\n| `-pktnum` | none | Show packet number |\n| `-r` | str | Read a .pcap file |\n| `-w` | str | Write a .pcap file with all the scanned packets |\n\n### ```print```\nThis command is used to display detailed informations for a specific packet.\nThe following table lists the allowed arguments for this command.\n\n| Arg | Value | Description |\n|--------|------------|---------|\n| `-n` | int | Choose a packet by its scanning order number |\n| `-e` | none | Show datalink layer protocol header |\n| `-nnet` | none | Don't show network layer protocol header |\n| `-t` | none | Show transport layer protocol header |\n| `-a` | none | Show application layer protocol header |\n| `-ntime` | none | Hide timestamp |\n| `-npname` | none | Hide protocol name in the output |\n| `-output` | (std, raw, art) | Select output format |\n| `-pktnum` | none | Show packet number |\n\n### ```dissectors```\nThis command is used to manage custom dissectors.\nThe following table lists the allowed arguments for this command.\n\n| Arg | Value | Description |\n|--------|------------|---------|\n| `-list` | none | Show custom dissectors list |\n| `-add` | str | Add custom dissector |\n| `-on` | str | Activate custom dissector (empty = all) |\n| `-off` | str | Deactivate custom dissector (empty = all) |\n\n## ```protocols```\nThis command is used to retrieve a list of supported protocols.\nThe following table lists the allowed arguments for this command.\n\n| Arg | Value | Description |\n|--------|------------|---------|\n| `-tables` | none | Show supported protocol tables |\n| `-from` | str | Show supported protocols from the specified tables |\n| `-search` | int | Looks up a protocol by number. If 'from' is set, the search is limited to the specified tables |\n\n### ```save```\nThis command is used to save scanned packets to a .pcap file.\nThe following table lists the allowed arguments for this command.\n\n| Arg | Value | Description |\n|--------|------------|---------|\n| `-to` | str | Specify the destination file for saving scanned data |\n| `-n` | int | Choose the single packet to save by its scanning order number |\n\n### ```scantree```\nThis command is used to obtain the hierarchical structures of the protocols currently being scanned.\n\n### ```reset```\nThis command is used to reset stored packets.\n\n### ```devlist```\nThis command is used to retrieve a list of all available devices for scanning.\n\n### ```clear```\nThis command is used to clear screen output.\n\n### ```exit```\nThis command is used to exit program.\n\n\n## Adding custom dissectors\nTo create a custom dissector, refer to the ```netdump-devel``` repo (https://github.com/giorgiopapini/netdump-devel).\nThe ```netdump-devel``` package allows you to compile your custom dissector as a shared library. Once compiled as a shared lib, you can add it to netdump using the following command:\n```netdump dissectors -add \"path-to-dissector.so\"``` (.so if your system is Linux or *BSD. Otherwise, adjust it according to your system).\n\n## Benchmark\nI compared netdump with tcpdump in terms of speed, and these are the results I obtained (I disabled hostname resolution in tcpdump to make it faster).\nThe following are some of the comparisons I made. For others, check the assets folder.\n\n\u003cp float=\"left\"\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/giorgiopapini/netdump/assets/assets/arp_netdump.png\" width=\"400\"/\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/giorgiopapini/netdump/assets/assets/arp_tcpdump.png\" width=\"400\"/\u003e\n\u003c/p\u003e\n\u003cp float=\"left\"\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/giorgiopapini/netdump/assets/assets/dns_netdump.png\" width=\"400\"/\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/giorgiopapini/netdump/assets/assets/dns_tcpdump.png\" width=\"400\"/\u003e\n\u003c/p\u003e\n\u003cp float=\"left\"\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/giorgiopapini/netdump/assets/assets/tcp_netdump.png\" width=\"400\"/\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/giorgiopapini/netdump/assets/assets/tcp_tcpdump.png\" width=\"400\"/\u003e\n\u003c/p\u003e\n\nHowever, the problem is that netdump does not support the extensive range of protocols that tcpdump does. Therefore, I focused on measuring TCP packets by adding \"dummy\" protocol handlers to the proto_tables that netdump queries while dissecting a TCP packet.\nThe result is still amazing.\n[Watch the video](https://raw.githubusercontent.com/giorgiopapini/netdump/assets/assets/netdump_benchmark.mp4)\n\n## Contributing\nContributions are welcome and really appreciated. To increase the popularity and usefulness of netdump, support for additional protocols is highly encouraged. Contributions of new protocol dissectors are especially welcome and appreciated, though all types of contributions are valued.\nThe following is a quick start guide explaining how to practically contribute to the project:\n\n### 1. Fork the repo\nClick the fork button to create your own fork of the project\n\n### 2. Clone your own fork\n```bash\ngit clone git@github.com:YOUR-USERNAME/netdump.git\ncd netdump\n```\n\n### 3. Create a new branch\n```bash\ngit checkout -b your-branch-name\n```\n\n### 4. Make your changes and push\nMake your improvements or bug fixes than commit and push.\n```bash\ngit add .\ngit commit -m \"Describe your changes precisely\"\ngit push origin your-branch-name\n```\n### 5. Submit a Pull Request\nGo to the original repository and open a pull request from your fork.\n\n## Screenshots\n![Screenshot](https://raw.githubusercontent.com/giorgiopapini/netdump/assets/assets/screen1.png)\n![Screenshot](https://raw.githubusercontent.com/giorgiopapini/netdump/assets/assets/screen2.png)\n![Screenshot](https://raw.githubusercontent.com/giorgiopapini/netdump/assets/assets/screen3.png)\n![Screenshot](https://raw.githubusercontent.com/giorgiopapini/netdump/assets/assets/screen4.png)\n![Screenshot](https://raw.githubusercontent.com/giorgiopapini/netdump/assets/assets/screen5.png)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgiorgiopapini%2Fnetdump","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgiorgiopapini%2Fnetdump","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgiorgiopapini%2Fnetdump/lists"}