Skip to content

README.md

Latest commit

 

History

History
56 lines (38 loc) · 1.2 KB

README.md

File metadata and controls

56 lines (38 loc) · 1.2 KB
Raw

Java PCAP file parser

Description

Java Pcap Parser used to parse pcap files generated from applications like Wireshark.

It uses pure Java 25 API, no external libraries.

Implementation is based on the following documentation: https://datatracker.ietf.org/doc/draft-ietf-opsawg-pcap/

It is not intended to be used for .pcapng files

Requirements

  • Java 25+ (if you want to run the parser without docker)
  • Docker (if you want to run the parser in a Docker container)
  • A .pcap file to parse

Build without docker

javac PcapParser.java

Build with docker

docker build -t pcap-parser .

Run without docker

To run the parser, execute the following command:

java PcapParser <pcap_file_path> --proto<tcp|udp|dns|arp|icmp> (optional)

Run with docker

To run the parser in a Docker container, execute the following command:

docker run --rm -v "$PWD:/data" pcap-parser /data/<your_pcap_file>.pcap --proto<tcp|udp|dns|arp|icmp> (optional)

Protocols supported

  • TCP
  • UDP
  • DNS
  • ARP
  • ICMP
  • QUIC with minimal parse (enabled if you run with the udp flag)

Screenshots

An exemple of the output of the parser: Screenshot