https://github.com/rtckit/php-pcap-ffi
:mag: PHP Packet Capture Library
https://github.com/rtckit/php-pcap-ffi
ffi network-security packet-capture packet-sniffer pcap php-library
Last synced: 5 months ago
JSON representation
:mag: PHP Packet Capture Library
- Host: GitHub
- URL: https://github.com/rtckit/php-pcap-ffi
- Owner: rtckit
- License: mit
- Created: 2020-09-02T19:34:01.000Z (almost 6 years ago)
- Default Branch: master
- Last Pushed: 2022-12-01T05:01:05.000Z (over 3 years ago)
- Last Synced: 2025-08-04T08:59:59.014Z (10 months ago)
- Topics: ffi, network-security, packet-capture, packet-sniffer, pcap, php-library
- Language: PHP
- Homepage:
- Size: 33.2 KB
- Stars: 9
- Watchers: 2
- Forks: 1
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# PHP Packet Capture via FFI
Stream driven PHP packet capture library, leveraging libpcap via FFI.
[](https://travis-ci.com/rtckit/php-pcap-ffi)
[](https://packagist.org/packages/rtckit/pcap-ffi)
[](https://codeclimate.com/github/rtckit/php-pcap-ffi/maintainability)
[](LICENSE)
## Pcap Extension
Whenever possible (or if using an older version of PHP), you should use the native [pcap PHP extension](https://github.com/rtckit/php-pcap-ext), this library is provided as an alternative to it for select/edge cases. Otherwise, the FFI based packet capture library is fully compatible with the `pcap` extension. As a result, all changes applied to the extension are reflected here too, and the library version will always match its extension counterpart.
## Requirements
This library makes use of features introduced as of PHP 7.4, it will not work with obsolete versions. Of course, the [PHP FFI extension](https://www.php.net/manual/en/book.ffi.php) must be installed and enabled.
The libpcap library must be installed on the target environment; some Linux distributions meddle with the library naming protocols and this can confuse the FFI initialization process. Should that be the case, one can set the `LIBPCAP_NAME` environment variable to the actual library name, or even the absolute path to the library's .so file for custom builds or non-standard directory layouts.
For example, for Debian Buster, one would set `LIBPCAP_NAME` to `libpcap.so.1.8.1`.
## Install
The recommended way to install this library is [through Composer](https://getcomposer.org). [New to Composer?](https://getcomposer.org/doc/00-intro.md)
This will install the latest supported version:
```sh
composer require rtckit/pcap-ffi:^0.6.5
```
## Tests
Before running the test suite, make sure the user has the ability to capture network packets (root or `CAP_NET_RAW`).
```sh
make test
```
## License
MIT, see [LICENSE file](LICENSE).
### Acknowledgments
* [libpcap](https://github.com/the-tcpdump-group/libpcap) by The Tcpdump Group, BSD licensed.
### Contributing
Bug reports (and small patches) can be submitted via the [issue tracker](https://github.com/rtckit/php-pcap-ffi/issues). Forking the repository and submitting a Pull Request is preferred for substantial patches.