https://github.com/nbareil/net2pcap

Net2PCAP is a simple network-to-pcap capture file for Linux. Its goal is to be as simple as possible to be used in hostile environments
https://github.com/nbareil/net2pcap

fpc network pcap tcpdump

Last synced: 3 months ago
JSON representation

Net2PCAP is a simple network-to-pcap capture file for Linux. Its goal is to be as simple as possible to be used in hostile environments

• Host: GitHub
• URL: https://github.com/nbareil/net2pcap
• Owner: nbareil
• Created: 2011-08-26T17:18:01.000Z (about 13 years ago)
• Default Branch: master
• Last Pushed: 2013-07-17T12:14:05.000Z (over 11 years ago)
• Last Synced: 2024-04-24T13:20:46.752Z (7 months ago)
• Topics: fpc, network, pcap, tcpdump
• Language: C
• Homepage:
• Size: 157 KB
• Stars: 38
• Watchers: 4
• Forks: 20
• Open Issues: 4
• Metadata Files:
  • Readme: README

Awesome Lists containing this project

• awesome-network-stuff - **32**星

README

        
Net2PCAP is a simple network to pcap capture file for Linux. Its goal

is to be as simple as possible (hence auditable) so that good

confidence can be reached, for it to be used in hostile

environments.

It does not require any library except a bit of libc. It does not do

anything except dumping network traffic from an interface to a pcap

file. It is less than 600 lines of C. Please audit it !

Comparison with tcpdump

  * Yes, tcpdump -w capfile can do almost the same. But the goal of

    tcpdump is network debugging (thus, lot of options, packet

    disassembly, etc.). The goal of net2pcap is to capture traffic into

    a file in hostile environments (honeypots, internet, etc.) for

    future analysis.

  * net2pcap can run in daemon mode

  * net2pcap can reopen its capture file (SIGHUP) (used for capture file rotation)

  * net2pcap does not do anything else than reading from network and dumping to file

  * net2pcap does not use libpcap

  * net2pcap drops its privileges

  * net2pcap sandboxes itself (if libseccomp is available)

  * net2pcap runs only on Linux

  * net2pcap is auditable (less than 600 lines)

Original code from Philippe Biondi, bugs added by Nicolas Bareil :)