cap

Description

A binding for performing packet capturing with node.js.

This binding is tested on Windows and Linux.

Requirements

• node.js -- v0.8.0 or newer

• For Windows: WinPcap

• For *nix: libpcap and libpcap-dev packages

Install

npm install cap

Examples

• Capture all outgoing TCP data packets destined for port 80 on the interface for 192.168.0.10:

var Cap = require('cap').Cap;

var c = new Cap(),
    device = Cap.findDevice('192.168.0.10'),
    filter = 'tcp and dst port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) > 0)',
    bufSize = 10 * 1024 * 1024,
    buffer = new Buffer(65535);

p.open(device, filter, bufSize, buffer);
p.on('packet', function(nbytes, trunc) {
  console.log('packet: length ' + nbytes + ' bytes, truncated? '
              + (trunc ? 'yes' : 'no'));
  // raw packet data === buffer.slice(0, nbytes)
});

• List all network devices:

var Cap = require('cap').Cap;

console.dir(Cap.deviceList());

// example output on Linux:
// [ { name: 'eth0',
//     addresses:
//      [ { addr: '192.168.0.10',
//          netmask: '255.255.255.0',
//          broadaddr: '192.168.0.255' } ] },
//   { name: 'nflog',
//     description: 'Linux netfilter log (NFLOG) interface',
//     addresses: [] },
//   { name: 'any',
//     description: 'Pseudo-device that captures on all interfaces',
//     addresses: [] },
//   { name: 'lo',
//     addresses:
//      [ { addr: '127.0.0.1', netmask: '255.0.0.0' },
//        { addr: '::1',
//          netmask: 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff' } ],
//     flags: 'PCAP_IF_LOOPBACK' } ]

API

Cap events

• packet(< integer >nbytes, < boolean >truncated) - A packet nbytes in size was captured. truncated indicates if the entire packet did not fit inside the Buffer supplied to open().

Cap methods

• (constructor)() - Creates and returns a new Cap instance.

• open(< string >device, < string >filter, < integer >bufSize, < Buffer >buffer) - (void) - Opens device and starts capturing packets using filter. bufSize is the size of the internal buffer that libpcap uses to temporarily store packets until they are emitted. buffer is a Buffer large enough to store one packet. If open() is called again without a previous call to close(), an implicit close() will occur first.

• close() - (void) - Stops capturing.

Cap static methods

• findDevice(< string >ip) - mixed - Returns the (first) device name associated with ip, or undefined if not found.

• deviceList() - array - Returns a list of available devices and related information.

TODO

• Packet decoding?