libtins - High-level, multiplatform C++ network packet sniffing and crafting library.

  •        100

libtins is a high-level, multiplatform C++ network packet sniffing and crafting library. Its main purpose is to provide the C++ developer an easy, efficient, platform and endianess-independent way to create tools which need to send, receive and manipulate specially crafted packets.




Related Projects

scapy - Scapy: the Python-based interactive packet manipulation program & library

  •    Python


netsniff-ng - The packet sniffing beast

  •    C


Divert - Windows Packet Divert

  •    C

Windows Packet Divert (WinDivert) is a user-mode packet interception library for Windows 7, Windows 8 and Windows 10. WinDivert enables user-mode capturing/modifying/dropping of network packets sent to/from the Windows network stack. In summary, WinDivert can Capture network packets, Filter/drop network packets, Sniff network packets, (re)inject network packets, modify network packets. It can be used to implement user-mode packet filters, sniffers, firewalls, NATs, VPNs, IDSs, tunneling applications, etc.

TCPDump - Network Packet Analyzer

  •    C


npcap - Nmap Project's packet sniffing library for Windows, based on WinPcap/Libpcap improved with NDIS 6 and LWF

  •    C

Npcap is an update of WinPcap to NDIS 6 Light-Weight Filter (LWF) technique. It supports Windows Vista, 7, 8 and 10. It is sponsored by the Nmap Project and developed by Yang Luo under Google Summer of Code 2013 and 2015. It also received many helpful tests from Wireshark, libpcap and NetScanTools.Run git clone https://github.com/nmap/npcap: pull this repo. This repo contains libpcap as a submodule, so make sure that you have also pulled all the submodules.

Moloch - Large scale, full packet capturing, indexing, and database system

  •    Javascript


tcpreplay - Pcap editing and replay tools for *NIX and Windows - Users please download source from

  •    C


NetworkMiner packet analyzer

  •    CSharp

NetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows that can detect the OS, hostname and open ports of network hosts through packet sniffing or by parsing a PCAP file. NetworkMiner can also extract transmitted files from network traffic. A professional edition of NetworkMiner is available for purchase from NETRESEC at http://www.netresec.com/?page=NetworkMiner

wireshark - Read-only mirror of Wireshark's Git repository

  •    C

Wireshark is a network traffic analyzer, or "sniffer", for Unix and Unix-like operating systems. It uses Qt, a graphical user interface library, and libpcap, a packet capture and filtering library. The Wireshark distribution also comes with TShark, which is a line-oriented sniffer (similar to Sun's snoop, or tcpdump) that uses the same dissection, capture-file reading and writing, and packet filtering code as Wireshark, and with editcap, which is a program to read capture files and write the packets from that capture file, possibly in a different capture file format, and with some packets possibly removed from the capture.


  •    Java

JavaSock provides a combination Java API and native code library allowing Java programs to manipulate raw network packets through a consistent and secure interface. The API supports applications including packet filtering and packet sniffing.



Light OpenSource network measurement probe that uses pcap to generate packetID for traversing packets for packet tracking and hop-by-hop delay measurements. Hash-based packet selection is also supported and results are exported via IPFIX.

joy - A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring

  •    C

Joy is a BSD-licensed libpcap-based software package for extracting data features from live network traffic or packet capture (pcap) files, using a flow-oriented model similar to that of IPFIX or Netflow, and then representing these data features in JSON. It also contains analysis tools that can be applied to these data files. Joy can be used to explore data at scale, especially security and threat-relevant data. JSON is used in order to make the output easily consumable by data analysis tools. While the JSON output files are somewhat verbose, they are reasonably small, and they respond well to compression.

Network Packet Capture Facility for Java

  •    Java

jpcap is a set of Java classes which provide an interface and system for network packet capture. A protocol library and tool for visualizing network traffic is included. jpcap utilizes libpcap, a widely deployed system library for packet capture.

PacketSender - Network utility for sending / receiving TCP, UDP, SSL

  •    C++

Packet Sender is an open source utility to allow sending and receiving TCP, UDP, and SSL (encrypted TCP) packets. The mainline branch officially supports Windows, Mac, and Desktop Linux (with Qt). Other places may recompile and redistribute Packet Sender. Packet Sender is free and licensed GPL v2 or later. It can be used for both commercial and personal use. Official releases of Packet Sender can be downloaded at PacketSender.com. Some places redistribute Packet Sender.

JamWiFi - A GUI, easy to use WiFi network jammer for Mac OS X

  •    Objective-C

JamWiFi allows you to select one or more nearby wireless networks, thereupon presenting a list of clients which are currently active on the network(s). Furthermore, JamWiFi allows you to disconnect clients of your choosing for as long as you wish. Under the hood, JamWiFi uses Apple's CoreWLAN API for channel hopping and network scanning. For a raw packet interface, libpcap provides a good point of abstraction for sending/receiving raw 802.11 frames at the MAC layer. All 802.11 MAC packets include a MAC address source and destination. This allows JamWiFi to determine the stations on a given Access Point.

Packet Construction Set

  •    Python

Packet Construction Set is a group of Python modules meant to make writing programs that deal with network packets more easily. PCS contains a core set of classes for writing packets and packet classes that cover most of the TCP/IP suite of protocol

Bit-Twist (Packet Generator)

  •    C

Bit-Twist is a simple yet powerful libpcap-based Ethernet II (IEEE 802.3) packet generator that comes complete with a comprehensive pcap capture file editor. Bit-Twist runs on Mac OS X (and *BSD), Linux, and Windows.

multidiff - Binary data diffing for multiple objects or streams of data

  •    Python

It's purpose is to make machine friendly data easier to understand by humans that are looking at it. Specifically multidiff helps in viewing the differences within a large set of objects by doing diffs between relevant objects and displaying them in a sensible manner. This kind of visualization is handy when looking for patterns and structure in proprietary protocols or weird file formats. The obvious use-cases are reverse engineering and binary data analysis. At the core of multidiff is the python difflib library and multidiff wraps it in data providing mechanisms and visualization code. The visualization is the most important part of the project and everything else is just utilities to make it easier to feed data for the visualizer. At this time the tool can do basic format parsing such as hex decoding, hexdumping, and handling data as utf8 strings, as well as read from files, stdin, and sockets. Any preprocessing such as cropping, indenting, decompression, etc. will have be done by the user before the objects are provided to multidiff.

skydive - An open source real-time network topology and protocols analyzer

  •    Go
