PcapNG Analyzer

A comprehensive network packet analyzer that provides both a native CLI tool and a Model Context Protocol (MCP) server for deep analysis of PcapNG and PCAP network capture files.

🎯 Features

✅ Dual Interface - Native CLI tool + MCP server for AI integration
✅ Complete Packet Analysis - Deep protocol parsing with headers, payloads, and metadata
✅ Network Flow Analysis - Track conversations, bandwidth usage, and connection patterns
✅ Protocol Intelligence - Ethernet, IPv4, TCP/UDP parsing with application layer detection
✅ Advanced Analytics - Timing analysis, protocol distribution, and traffic statistics
✅ Multiple Formats - PcapNG, PCAP support with human-readable, JSON, and table outputs
✅ Real-time Insights - Payload previews, packet flags, MAC addresses, and port analysis
✅ Production Ready - High-performance Rust implementation with comprehensive error handling

🚀 Quick Start

Primary CLI Tool (pcapng-cli)

# Build CLI tool
cargo build --features cli --release

# Parse detailed packets with protocol analysis
./target/release/pcapng-cli packets capture.pcapng --limit 10 --payload

# Analyze network flows and conversations
./target/release/pcapng-cli flows capture.pcapng --sort-by-count

# Generate comprehensive traffic analysis
./target/release/pcapng-cli analyze capture.pcapng --protocols --timing

# Get file information
./target/release/pcapng-cli info capture.pcapng

# Multiple output formats
./target/release/pcapng-cli packets capture.pcapng --format json
./target/release/pcapng-cli flows capture.pcapng --format table

Advanced CLI Tool (pcapng-analyzer)

# Build advanced analyzer
cargo build --features cli --release

# Batch analysis of multiple files
./target/release/pcapng-analyzer batch --dir ./captures --summary

# Compare two capture files
./target/release/pcapng-analyzer compare file1.pcapng file2.pcapng --packets --timing

# Generate detailed statistics
./target/release/pcapng-analyzer stats capture.pcapng --protocols --detailed

MCP Server (AI Integration)

# Build MCP server
cargo build --features mcp-server --release

# Start MCP server (connects via stdio)
./target/release/pcapng-mcp-server

# Test MCP server manually
echo '{"jsonrpc": "2.0", "id": 1, "method": "tools/list"}' | ./target/release/pcapng-mcp-server

MCP Client Integration

// Initialize MCP server
{"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {}}

// List all available analysis tools
{"jsonrpc": "2.0", "id": 2, "method": "tools/list"}

// Parse detailed packets with protocol analysis
{"jsonrpc": "2.0", "id": 3, "method": "tools/call", "params": {
  "name": "parse_detailed_packets", 
  "arguments": {"file_path": "/path/to/capture.pcapng", "limit": 10}
}}

// Analyze network flows
{"jsonrpc": "2.0", "id": 4, "method": "tools/call", "params": {
  "name": "analyze_packet_flows", 
  "arguments": {"file_path": "/path/to/capture.pcapng"}
}}

🛠️ Analysis Tools Available

Primary CLI Commands (pcapng-cli)

Command	Description	Example
`packets`	Deep packet analysis with protocol headers, payloads, and metadata	`pcapng-cli packets file.pcap --limit 5 --payload`
`flows`	Network flow analysis tracking conversations and bandwidth	`pcapng-cli flows file.pcap --sort-by-count`
`analyze`	Comprehensive traffic analytics with protocol distribution and timing	`pcapng-cli analyze file.pcap --protocols --timing`
`info`	Basic file information and metadata	`pcapng-cli info file.pcap`
`interfaces`	Network interface details	`pcapng-cli interfaces file.pcap`
`timing`	Packet timing analysis	`pcapng-cli timing file.pcap`

Advanced CLI Commands (pcapng-analyzer)

Command	Description	Example
`batch`	Multi-file analysis with summary reports	`pcapng-analyzer batch --dir ./captures --summary`
`compare`	File comparison with detailed diff analysis	`pcapng-analyzer compare file1.pcap file2.pcap --packets`
`stats`	Advanced statistics with protocol breakdown	`pcapng-analyzer stats file.pcap --protocols --detailed`
`validate`	File integrity and format validation	`pcapng-analyzer validate file.pcap`
`export`	Export to different formats (CSV, JSON, etc.)	`pcapng-analyzer export file.pcap --format csv`

MCP Server Tools

Tool	Description	Capabilities
`parse_detailed_packets`	Advanced packet parsing	Ethernet/IP/TCP headers, payload preview, protocol stack
`analyze_packet_flows`	Flow analysis and tracking	Conversations, bandwidth, duration, connection patterns
`generate_packet_analysis`	Comprehensive analytics	Protocol distribution, timing analysis, packet statistics
`parse_pcapng_file`	Basic file parsing	File info, packet counts, interfaces
`get_pcapng_metadata`	File metadata extraction	Structure details, capture info
`list_pcapng_interfaces`	Interface enumeration	Network interface details

📋 Detailed Packet Analysis Example

CLI Output Sample

$ ./target/release/pcapng-cli packets capture.pcapng --limit 3 --payload

📦 Detailed Packet Analysis
===========================
📁 File: capture.pcapng
📊 Total packets parsed: 3

📦 Packet #1
   🕒 Timestamp: 2025-08-01 11:40:21.351025 UTC
   📏 Size: 42 bytes (captured: 42)
   🔗 Protocols: Ethernet
   🖧  Ethernet: 00:ae:c8:9c:93:6b → ea:03:a2:68:0f:96
   📄 Payload: Hex: 00 01 08 00 06 04 00 01... | ASCII: ................

📦 Packet #2
   🕒 Timestamp: 2025-08-01 11:40:21.337661 UTC
   📏 Size: 345 bytes (captured: 345)
   🔗 Protocols: Ethernet → IPv4 → TCP
   🖧  Ethernet: bc:24:11:c8:7d:65 → c2:06:cc:7f:3f:fe
   🌐 IP: 62.24.65.220 → 77.48.2.30 (TTL: 128, Protocol: TCP)
   🔌 TCP: 3389 → 54591
   🏁 TCP Flags: ---PA---
   📄 Payload: Hex: 17 03 03 01 1e 00 00... | ASCII: ...............

MCP JSON Response Sample

{
  "packet_count": 1,
  "packets": [{
    "packet_number": 1,
    "timestamp": "2025-08-01T11:40:21.351025Z",
    "captured_length": 345,
    "original_length": 345,
    "protocols": ["Ethernet", "IPv4", "TCP"],
    "ethernet_header": {
      "source_mac": "bc:24:11:c8:7d:65",
      "destination_mac": "c2:06:cc:7f:3f:fe",
      "ethertype": 2048,
      "ethertype_name": "IPv4"
    },
    "ip_header": {
      "version": 4,
      "source_ip": "62.24.65.220",
      "destination_ip": "77.48.2.30",
      "protocol": 6,
      "protocol_name": "TCP",
      "ttl": 128,
      "header_length": 20
    },
    "transport_header": {
      "protocol": "TCP",
      "source_port": 3389,
      "destination_port": 54591,
      "tcp_flags": {
        "syn": false,
        "ack": true,
        "psh": true,
        "fin": false,
        "rst": false,
        "urg": false
      }
    },
    "payload_preview": "Hex: 17 03 03 01 1e 00... | ASCII: ..............."
  }]
}

🌊 Network Flow Analysis Example

CLI Flow Analysis

$ ./target/release/pcapng-cli flows capture.pcapng --sort-by-count

🌊 Network Flow Analysis
========================
📁 File: capture.pcapng
📊 Total flows: 65

🌊 Flow: 62.24.65.220:3389 → 77.48.2.30:54591 (TCP)
   📦 Packets: 541
   📊 Bytes: 299,347
   ⏱️  Duration: 15.345s
   🕒 First seen: 2025-08-01 11:40:21.337661 UTC
   🕒 Last seen: 2025-08-01 11:40:36.682810 UTC

🌊 Flow: 77.48.2.3:51875 → 62.24.65.220:443 (TCP)
   📦 Packets: 121
   📊 Bytes: 45,876
   ⏱️  Duration: 7.473s

📊 Comprehensive Analytics Example

Protocol Distribution & Statistics

$ ./target/release/pcapng-cli analyze capture.pcapng --protocols --timing

📊 Comprehensive Packet Analysis
================================
📦 Total packets: 2189

📋 Protocol Distribution:
   Ethernet        2189     (100.0%)
   TCP             1568     (71.6%)
   IPv4            1620     (74.0%)
   UDP             52       (2.4%)

📏 Packet Size Statistics:
   Min size: 42 bytes
   Max size: 1514 bytes
   Average size: 262.3 bytes

⏱️  Timing Analysis:
   Total duration: 15.438s
   Average PPS: 141.8
   Peak PPS: 892.5

💬 Top Conversations:
   62.24.65.220 ↔ 77.48.2.30    1020 packets, 341,053 bytes
   77.48.2.3 ↔ 62.24.65.220     282 packets, 99,745 bytes

🏗️ Architecture

The PcapNG Analyzer employs a modular architecture designed for both standalone operation and MCP integration:

pcapng-analyzer/
├── src/
│   ├── lib.rs              # Core library exports
│   ├── pcapng/
│   │   ├── mod.rs          # PcapNG module root
│   │   ├── parser.rs       # Basic file parsing
│   │   ├── packet_parser.rs # Detailed packet analysis
│   │   ├── flow_analyzer.rs # Network flow tracking
│   │   └── types.rs        # Common data structures
│   ├── mcp/
│   │   ├── mod.rs          # MCP module root
│   │   ├── server.rs       # JSON-RPC 2.0 server
│   │   └── client.rs       # MCP client utilities
│   └── bin/
│       ├── cli.rs          # Native CLI application
│       └── mcp_server.rs   # MCP server binary
├── Cargo.toml              # Multi-binary configuration
└── README.md

Key Components

🔧 Core Parser (src/pcapng/)

Standards-compliant PcapNG file parsing
Protocol-aware packet dissection (Ethernet, IP, TCP, UDP)
Network flow reconstruction and analysis
Performance optimized for large captures

🖥️ CLI Interface (src/bin/cli.rs)

Direct command-line access to all analysis features
Multiple output formats (human-readable, JSON)
Batch processing capabilities
Real-time analysis feedback

🔌 MCP Server (src/mcp/server.rs)

JSON-RPC 2.0 compliant implementation
Six specialized analysis tools
Seamless integration with MCP-compatible clients
Structured data output for programmatic access

⚙️ Build System

Feature-gated compilation (cli, mcp-server)
Conditional dependencies for optimized builds
Release builds for production deployment

� Getting Started

Quick Analysis Demo

# Clone and build
git clone https://github.com/your-org/pcapng-analyzer
cd pcapng-analyzer
cargo build --release --features cli

# Analyze a capture file
./target/release/pcapng-cli analyze demo.pcapng --protocols --timing

# Extract detailed packets
./target/release/pcapng-cli packets demo.pcapng --limit 10 --payload

MCP Integration Demo

# Start MCP server
./target/release/pcapng-mcp-server

# In MCP client, available tools:
# - parse_pcapng_file
# - get_pcapng_metadata  
# - list_pcapng_interfaces
# - parse_detailed_packets
# - analyze_packet_flows
# - generate_packet_analysis

�📊 Tested With Real Files

Successfully tested with multiple real-world PcapNG files:

✅ 974 packets (19 second capture, 211KB file)
✅ 2189 packets (15 second capture, 647KB file, 2 interfaces)
✅ 282 packets (8 second capture, 109KB file, 2 interfaces)
✅ Various network protocols and interface configurations

🔧 Dependencies

Rust - Async/await, error handling, performance
rmcp - Model Context Protocol implementation
pcap-parser - Low-level packet parsing
serde - JSON serialization
tokio - Async runtime

🤝 Contributing

We welcome contributions! Whether you're fixing bugs, adding features, or improving documentation:

Fork the repository
Create a feature branch (git checkout -b feature/amazing-feature)
Commit your changes (git commit -m 'Add amazing feature')
Push to the branch (git push origin feature/amazing-feature)
Open a Pull Request

Development Setup

git clone https://github.com/your-org/pcapng-analyzer
cd pcapng-analyzer
cargo build --all-features
cargo test

📜 License

This project is licensed under the MIT License - see the LICENSE file for details.

🙏 Acknowledgments

pcap-parser - Robust PcapNG parsing foundation
rmcp - Model Context Protocol implementation
The network analysis community for inspiration and standards

Built with ❤️ for network analysis and automation

⭐ Star this repo • 🐛 Report Issues • 💡 Request Features

Name		Name	Last commit message	Last commit date
Latest commit History 4 Commits
.github		.github
src		src
.gitignore		.gitignore
Cargo.toml		Cargo.toml
README.md		README.md

Uh oh!

itsalfredakku/pcapng-analyzer

Folders and files

Latest commit

History

Repository files navigation

PcapNG Analyzer

🎯 Features

🚀 Quick Start

Primary CLI Tool (pcapng-cli)

Advanced CLI Tool (pcapng-analyzer)

MCP Server (AI Integration)

MCP Client Integration

🛠️ Analysis Tools Available

Primary CLI Commands (pcapng-cli)

Advanced CLI Commands (pcapng-analyzer)

MCP Server Tools

📋 Detailed Packet Analysis Example

CLI Output Sample

MCP JSON Response Sample

🌊 Network Flow Analysis Example

CLI Flow Analysis

📊 Comprehensive Analytics Example

Protocol Distribution & Statistics

🏗️ Architecture

Key Components

� Getting Started

Quick Analysis Demo

MCP Integration Demo

�📊 Tested With Real Files

🔧 Dependencies

🤝 Contributing

Development Setup

📜 License

🙏 Acknowledgments

About

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Sponsor this project

Uh oh!

Packages 0

Languages

Packages