FPCAP is a modern, simple and lightweight C++ alternative to libpcap for reading packet capture files. It supports advanced features like memory-mapping for efficiently processing large input files, without the overhead of a full-blown packet capture framework. If you want to easily access packets from .pcap or .pcapng files, this library is for you.

• Memory-mapping Pcap & PcapNG reading
• Pcap & PcapNG writing
• Modified Pcap support
• Supported PcapNG block types:
  • Section Header Block
  • Interface Description Block
  • Enhanced Packet Block
  • Simple Packet Block
  • Interface Statistics Block
• Rudimentary support for block options
• Zstd de-compression support (file-endings .zst or .zstd)
• Range-based for loop iteration over packets
• Cross-platform: Linux, macOS, Windows

include(FetchContent)
FetchContent_Declare(
    fpcap
    GIT_REPOSITORY https://github.com/fpcap/fpcap.git
    GIT_TAG v0.2.0
)
FetchContent_MakeAvailable(fpcap)

target_link_libraries(your_target PRIVATE fpcap::fpcap)

Reading packets from Pcap or PcapNG files via C++20 iterators:

#include <fpcap/fpcap.hpp>
...
fpcap::PacketReader reader("myfile.pcap");
for (const fpcap::Packet& packet : reader) {
    // packet.timestampSeconds, packet.captureLength, packet.data, ...
}

Or using the explicit reading API:

#include <fpcap/fpcap.hpp>
...
fpcap::PacketReader reader("myfile.pcap");
fpcap::Packet packet{};
while (!reader.isExhausted()) {
    if (reader.nextPacket(packet)) {
        // process packet
    }
}

Writing packets to a Pcap file:

#include <fpcap/fpcap.hpp>
#include <fpcap/filesystem/Writer.hpp>
...
fpcap::PacketReader reader("input.pcap");
auto writer = fpcap::Writer::getWriter("output.pcap", false);

for (const fpcap::Packet& packet : reader) {
    writer->write(packet);
}

• C++20 compatible compiler:
  • GCC (tested on Debian 11/12/13 and Ubuntu)
  • Clang
  • MSVC (Visual Studio)
• CMake 3.16 or newer
• Linux, macOS or Windows

cmake -B build .
cmake --build build --target fpcap

cmake -DFPCAP_BUILD_TESTS=ON -B build .
cmake --build build --target fpcap_testcd build && ctest

cmake -DFPCAP_BUILD_EXAMPLES=ON -B build .
cmake --build build

See fpcap-benchmark for performance comparisons against other libraries.

Contributions and feedback are welcome! Feel free to open an issue or a merge request.

This project is released into the public domain under the Unlicense.