Pcap
  • Introduction
  • Getting Started
    • Dependency management
    • Installing Libpcap or Npcap
    • Run as non root user
    • Logging
    • Obtaining the device list
    • Opening an adapter and capturing the packets
    • Capturing the packets without the callback
    • Capture statistics
    • Filtering the traffic
    • Write the packets to a capture file
    • Read packets from a capture file.
    • Sending packets
    • I/O Multiplexing
    • Restricted Method
  • Developer Guide
    • Branches to look
    • Build from Source
    • Notes
  • Packet Structure
    • Packet Header
    • Packet Buffer
  • Packet Codec
    • Using packet codec
    • Adding protocol support
  • Others
  • Thanks to
  • Fork me on Github
Powered by GitBook
On this page

Was this helpful?

  1. Getting Started

Filtering the traffic

In order to cause only certain packets to be returned when reading packets, a filter can be set on a pcap handle.

PreviousCapture statisticsNextWrite the packets to a capture file

Last updated 4 years ago

Was this helpful?

Filter syntax:

public static void main(String[] _args)
    throws ErrorException, PermissionDeniedException, PromiscuousModePermissionDeniedException,
        TimestampPrecisionNotSupportedException, RadioFrequencyModeNotSupportedException,
        NoSuchDeviceException, ActivatedException, InterfaceNotUpException,
        InterfaceNotSupportTimestampTypeException {
  var service = Service.Creator.create("PcapService");
  try (var pcap = service.live(service.interfaces(), new DefaultLiveOptions())) {
    pcap.setFilter("icmp", true);
    try {
      pcap.loop(
          10,
          (args, header, buffer) -> {
            System.out.println("Args     : " + args);
            System.out.println("Header   : " + header);
            System.out.println("Packet   : " + buffer);
          },
          "Hello pcap!");
    } catch (BreakException e) {
      System.err.println(e.getMessage());
    } catch (ErrorException e) {
      System.err.println(e.getMessage());
    }
  }
}
fun main() {
  val service = Service.Creator.create("PcapService")
  val pcap = service.live(service.interfaces(), DefaultLiveOptions())
  pcap.setFilter("icmp", true)
  try {
    pcap.loop(
      10,
      { args: String, header: PacketHeader, buffer: PacketBuffer ->
        println("Args     : $args")
        println("Header   : $header")
        println("Packet   : $buffer")
      },
      "Hello pcap!"
    )
  } catch (e: BreakException) {
    System.err.println(e.message)
  } catch (e: ErrorException) {
    System.err.println(e.message)
  }
  pcap.close()
}
def main(_args: Array[String]): Unit = {
  val service = Service.Creator.create("PcapService")
  val pcap = service.live(service.interfaces(), new DefaultLiveOptions())
  pcap.setFilter("icmp", true)
  try pcap.loop(10, (args: String, header: PacketHeader, buffer: PacketBuffer) => {
    println("Args     : ", args)
    println("Header   : ", header)
    println("Packet   : ", buffer)
  }, "Hello pcap!")
  catch {
    case e: BreakException =>
      System.err.println(e.getMessage)
    case e: ErrorException =>
      System.err.println(e.getMessage)
  }
  pcap.close()
}
https://www.tcpdump.org/manpages/pcap-filter.7.html