pcapy-ng

What is Pcapy-NG?

Pcapy-NG is a Python extension module that lets Python programs use the libpcap packet-capture library. It is a maintained replacement for Pcapy, which is no longer maintained and stopped working on Python 3.10 (issue). The classic Pcapy API — open_live, open_offline, loop, next, setfilter, dump_open and the rest — is unchanged, so existing Pcapy code keeps working; it builds on Linux, macOS and Windows (libpcap / Npcap), on Python 2.7 and on current Python 3.

On top of that it provides an optional set of capture primitives for programs where per-packet Python work is the bottleneck: loop_filtered classifies packets in C and invokes the callback only for the classes you admit, loop_to_buffer writes admitted packets into a buffer you own with the GIL released, next_batch returns many packets per call, filtered_stats exposes live counters, and set_fanout joins a live handle to a Linux PACKET_FANOUT group so several handles can share one interface's traffic. The classifier can track flow heads (the first N packets of each flow), match against arbitrarily large IPv4 address sets, and run a built-in security profile that tags DNS, HTTP, TLS/QUIC handshakes and TCP SYNs. All of it is opt-in — ignore it and pcapy-ng behaves exactly like Pcapy.

Install
Quick start
loop_filtered: filtering in C
Built-in security profile
next_batch: many packets per call
set_fanout: several handles on one interface
API reference
Examples
Building & compatibility
License & credits

Install

pip install pcapy-ng

Releases from 2.0.1 on ship an sdist plus Linux (x86_64/aarch64, glibc and musl) and macOS (x86_64/arm64) wheels for CPython 3.9–3.14; those wheels vendor libpcap, so nothing is compiled at install time. Everywhere else — Windows, BSD, and on 2.0.0 and older — pip falls back to the sdist, which needs a C++ compiler and libpcap headers (libpcap-dev / libpcap-devel; on Windows the Npcap SDK, with WPDPACK_BASE pointing at it). To build a checkout:

pip install .

The C sources still compile against Python 2.7, but the PEP 517 build requires setuptools >= 61 (Python 3 only), so a Python 2.7 build has to be driven the old way: python setup.py install.

Quick start

import pcapy

print(pcapy.findalldevs())                       # list devices

cap = pcapy.open_live("eth0", 65535, True, 100)  # device, snaplen, promiscuous, timeout(ms)
cap.setfilter("tcp port 80")                     # optional BPF filter (kernel-side)

while True:
    hdr, data = cap.next()
    if hdr is None:
        break
    print(hdr.getts(), hdr.getlen(), len(data))

cap.loop(-1, lambda hdr, data: print(len(data))) # ...or use a callback

cap = pcapy.open_offline("capture.pcap")         # read a saved capture
dumper = cap.dump_open("out.pcap")               # write packets out

hdr is a Pkthdr with getts() → (seconds, microseconds), getlen() (wire length) and getcaplen() (captured length). This is the original Pcapy surface, unchanged.

`loop_filtered`: filtering in C

cap.loop_filtered(cnt, callback, admit_mask=7, addr_set=b"", flow_cutoff=0)

loop_filtered classifies each packet in C, hands your callback(hdr, data, cls) only the packets you asked for, and drops the rest without building a Python object for them. On a busy link where most traffic is bulk you don't care about, that per-packet object + callback cost is the thing that makes a pure-Python sniffer fall behind; this avoids paying it.

Why not just a BPF filter?

Fair question — and for a lot of cases the answer is "use BPF." setfilter("udp port 53") runs in the kernel and is the right tool for stateless port/protocol matching. You can (and should) keep using it; loop_filtered runs after it.

loop_filtered exists for the two things a BPF program can't do, because BPF is stateless and size-limited:

Flow state — "give me the first N packets of each connection, drop the rest." BPF can't track flows. This is how you grab the start of every conversation (where the useful bytes are) while ignoring the bulk that follows.
Large set membership — "deliver packets whose source or destination is in this set of addresses," where the set has thousands or millions of entries. That won't fit in a BPF program; here it's an average O(1) hash lookup.

If you only need stateless port/proto matching, use BPF. Reach for loop_filtered when you need flow state or set membership (and you can combine both with a BPF prefilter).

Classes and the admit mask

Each delivered packet comes with a small integer cls saying why it was kept:

`cls`	Name	Meaning
`0`	`OTHER`	didn't match `flow_cutoff` or `addr_set`
`1`	`FLOW_HEAD`	within the first `flow_cutoff` packets of its flow
`2`	`SET_MATCH`	source or destination is in `addr_set`

Classes are mutually exclusive — each packet gets exactly one cls and increments exactly one counter. When a packet could be more than one, precedence is SET_MATCH > FLOW_HEAD > OTHER (a flow's first packet that is also a set hit is reported as SET_MATCH).

admit_mask is a bitmask over the class number — bit cls admits that class; the rest are dropped in C. Default 7 (= 1<<0 | 1<<1 | 1<<2) admits all three, so a bare loop_filtered behaves like loop but tagged + counted. To keep only flow heads and set matches, drop OTHER:

OTHER, FLOW_HEAD, SET_MATCH = 0, 1, 2
admit = (1 << FLOW_HEAD) | (1 << SET_MATCH)
stats = cap.loop_filtered(-1, my_cb, admit, addr_set, flow_cutoff=3)
# stats -> (admitted, dropped, n_other, n_flow_head, n_set_match)

The return value is (admitted, dropped, <count per class>). The per-class counts are independent of admit_mask, so admit_mask=0 profiles your traffic with no Python work at all.

Flow heads: the start of every connection

flow_cutoff=N delivers the first N packets of each flow (TCP and UDP) as FLOW_HEAD and lets you ignore the rest. The opening packets of a connection are where the interesting metadata lives — the requested hostname inside a TLS handshake, the first request line, the greeting of a text protocol — so this captures that and sheds the bulk payload after it.

def on_head(hdr, data, cls):
    # data is the start of a connection; parse out whatever you need (e.g. the TLS server name)
    print("connection start:", len(data), "bytes")
cap.loop_filtered(-1, on_head, (1 << 1), flow_cutoff=3)   # FLOW_HEAD only

What "flow" means here. A flow is keyed by the directional 5-tuple (src, dst, src_port, dst_port, protocol) — so the two directions of a connection are two flows, and flow_cutoff=N yields up to N packets per direction. There is no TCP-state tracking (it counts packets per key) and no time-based expiry; the flow table is a fixed ~12 MB hash (about 1M entries, allocated only when flow_cutoff > 0) that evicts the least-recently-seen key on collision — so memory is bounded even under high-cardinality UDP, at the cost of an occasional re-count when a long-idle flow is evicted. IP fragments are not reassembled (non-first fragments aren't matched as flow heads).

See examples/04_flow_heads.py.

Address-set matching

addr_set is a packed list of IPv4 addresses (4 bytes each, network order). Any packet whose source or destination is in it is delivered as SET_MATCH, regardless of port or protocol — a fast way to watch for traffic to/from a set of hosts (an allowlist, a blocklist, an asset inventory…). The set can be huge.

IPv4 only. The classifier operates on IPv4; IPv6 packets are always OTHER and never match addr_set. (setfilter("ip6 ...") still works for plain IPv6 capture.)

import socket
watch = ["198.51.100.10", "203.0.113.7"]
addr_set = b"".join(socket.inet_aton(ip) for ip in watch)
cap.loop_filtered(-1, on_match, (1 << 2), addr_set)       # SET_MATCH only

`loop_to_buffer`: filling a shared buffer

Same classification, but instead of calling Python per packet it writes the admitted packets into a writable buffer you provide, with the GIL released for the whole loop. Pair it with multiprocessing.shared_memory and a pool of workers when one thread isn't enough.

from multiprocessing import shared_memory
shm = shared_memory.SharedMemory(create=True, size=64 * 1024 * 1024)
res = cap.loop_to_buffer(-1, shm.buf, addr_set=addr_set, flow_cutoff=3)
# res -> (written, dropped, overflow, bytes_used, <count per class>)

Each record is [u32 caplen little-endian][u8 class][caplen bytes], written back-to-back with no padding/alignment. The only metadata stored is the caplen and the class — no timestamp and no wire length; if you need those, use loop_filtered (its callback gets the full Pkthdr). When the buffer fills, extra packets are counted in overflow instead of overrunning it. See examples/05_shared_memory_ring.py.

Live counters and non-Ethernet links

filtered_stats() returns the current run's (admitted, dropped, <per class>) counters and is safe to read from another thread while the loop runs.

loop_filtered needs to know where the IPv4 header starts, via l2_offset: 14 for Ethernet (default), 16 for Linux "cooked" capture (DLT_LINUX_SLL, the any device), 0 for raw IP (DLT_RAW). VLAN tags are skipped automatically. Derive it from cap.datalink():

OFFSETS = {pcapy.DLT_EN10MB: 14, pcapy.DLT_LINUX_SLL: 16, pcapy.DLT_RAW: 0}
cap.loop_filtered(-1, cb, l2_offset=OFFSETS.get(cap.datalink(), 14))

Built-in security profile

loop_filtered(..., profile=1) swaps the generic classifier for a built-in one aimed at security/traffic monitoring — it tags DNS, HTTP, TLS/QUIC handshakes, TCP SYNs and address-set hits in a single pass, configurable via dns_port, dpi_ports and tls_ports. It exists so tools like Maltrail can do their triage in C; if you're not building that kind of tool, ignore it and stay with the generic classes above.

index	`cls` id	name	meaning
0	`100`	DNS	UDP/TCP on `dns_port`
1	`101`	HTTP	payload-bearing TCP on a `dpi_ports` port
2	`102`	OTHER	none of the below (the shed-able bulk)
3	`103`	ADDR	src/dst in `addr_set` (any protocol, incl. ICMP)
4	`104`	HANDSHAKE	flow head on a `tls_ports` port (ClientHello / QUIC Initial)
5	`105`	SYN	bare TCP SYN

Two numbers, two jobs — this is the part to get right:

The cls id delivered to your callback is 100 + index (so it never collides with the generic 0/1/2).
admit_mask is a bitmask over the index, not the id. To admit DNS + ADDR you write (1 << 0) | (1 << 3) — not 1 << 100. The default mask for this profile is 59 (= 1<<0 | 1<<1 | 1<<3 | 1<<4 | 1<<5), i.e. everything except OTHER (index 2).

The per-class counts in the return tuple are in index order (admitted, dropped, dns, http, other, addr, handshake, syn).

`next_batch`: many packets per call

next_batch(max_n) reads up to max_n packets in a single call and returns them as (packet_bytes, packed_meta): packet_bytes is every packet concatenated, and packed_meta is an array of fixed 16-byte records — one per packet, four native-endian uint32s (sec, usec, offset, caplen) — where offset/caplen slice a packet out of packet_bytes. An empty packed_meta means EOF (offline) or timeout (live). It crosses the C↔Python boundary once per batch instead of once per packet, and unlike loop_filtered it does no classification — you get everything, with timestamps.

import struct
pkts, meta = cap.next_batch(1024)
for i in range(0, len(meta), 16):
    sec, usec, off, caplen = struct.unpack_from("=IIII", meta, i)
    data = pkts[off:off + caplen]

`set_fanout`: several handles on one interface

One capture socket is one thread's worth of work. On Linux, set_fanout(group_id, fanout_type) joins a live, activated handle to a kernel PACKET_FANOUT group: open N handles on the same interface, put them all in the same group, read each in its own thread or process, and the kernel spreads the interface's packets across them without duplicating any. With the default PACKET_FANOUT_HASH every flow stays on one handle, so per-flow state stays consistent.

cap = pcapy.open_live(dev, 65535, True, 100)
cap.set_fanout(0x4711, pcapy.PACKET_FANOUT_HASH)

Constants: PACKET_FANOUT_HASH, PACKET_FANOUT_LB, PACKET_FANOUT_CPU, PACKET_FANOUT_ROLLOVER, PACKET_FANOUT_RND. Linux only, live handles only; anything else raises. See examples/07_fanout_scale.py.

API reference

Module: open_live(dev, snaplen, promisc, timeout_ms), open_offline(path), create(dev), findalldevs(), lookupdev(), compile(...), the DLT_*, PCAP_D_* and PACKET_FANOUT_* constants, and the PcapError / BPFError exceptions.

Reader (classic): next() → (hdr, data), loop(cnt, cb), dispatch(cnt, cb), setfilter(bpf), datalink(), getnet(), getmask(), getnonblock()/setnonblock(), setdirection(...), stats() → (recv, drop, ifdrop), dump_open(path), sendpacket(data), getfd(), close(). Usable as a context manager.

Reader (unactivated, from create()): set_snaplen(n), set_promisc(bool), set_timeout(ms), set_buffer_size(n), set_rfmon(bool) (monitor mode, where supported), then activate().

Reader (filtering):

Method	Purpose
`loop_filtered(cnt, cb, admit_mask=7, addr_set=b"", flow_cutoff=0, dpi_ports=None, tls_ports=None, dns_port=53, l2_offset=14, profile=0)`	classify in C; call `cb(hdr, data, cls)` only for admitted classes; return `(admitted, dropped, <per-class counts>)`
`loop_to_buffer(cnt, buf, ...same...)`	same, but write admitted packets into `buf` with the GIL released
`filtered_stats()`	live counter snapshot of the current/last run
`next_batch(max_n)`	read up to `max_n` packets in one call as `(packet_bytes, packed_meta)`
`set_fanout(group_id, fanout_type=PACKET_FANOUT_HASH)`	Linux: join this live handle to a kernel `PACKET_FANOUT` group

cnt = -1/0 means "until EOF (offline) or forever (live)".

Code that must also run against stock Pcapy can probe with hasattr(reader, "loop_filtered") and fall back to loop() / next().

Examples

Runnable, self-contained scripts in examples/ — each takes a device (live) or a .pcap (offline) as its first argument:

File	Shows
`01_sniff_live.py`	classic live capture with a BPF filter
`02_read_pcap.py`	read a `.pcap` and summarize it
`03_filter_in_c.py`	`loop_filtered`: tag + count, drop `OTHER` in C
`04_flow_heads.py`	grab the first packets of each connection (`flow_cutoff`)
`05_shared_memory_ring.py`	`loop_to_buffer` producer + multiprocess consumers
`06_live_stats.py`	poll `filtered_stats()` from another thread
`07_fanout_scale.py`	`set_fanout`: several capture threads on one interface (Linux)

Building & compatibility

Builds from source on Python 2.7 and Python 3.x, on Linux, macOS and Windows (libpcap / Npcap); all it needs is a C++ compiler and the libpcap headers. CI builds and tests every commit on CPython 3.9–3.14 (Linux and macOS). Wheels are produced for those two platforms only, with cibuildwheel, and vendor libpcap, so installing from a wheel needs no compiler or libpcap-dev. There are no Windows wheels — on Windows pip builds from the sdist against the Npcap SDK.

set_fanout is Linux-only; the classifier used by loop_filtered / loop_to_buffer is IPv4-only (IPv6 packets are always OTHER). Everything else is portable.

License & credits

Apache Software License — see LICENSE. Pcapy-NG is maintained by Miroslav Stampar (contact@sekuripy.hr) and builds on the original Pcapy by CORE Security. Bug reports, patches and suggestions welcome.

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

pcapy_ng-2.0.2.tar.gz (80.0 kB view details)

Uploaded Aug 15, 2026 Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

pcapy_ng-2.0.2-cp314-cp314-musllinux_1_2_x86_64.whl (1.3 MB view details)

Uploaded Aug 15, 2026 CPython 3.14musllinux: musl 1.2+ x86-64

pcapy_ng-2.0.2-cp314-cp314-musllinux_1_2_aarch64.whl (1.2 MB view details)

Uploaded Aug 15, 2026 CPython 3.14musllinux: musl 1.2+ ARM64

pcapy_ng-2.0.2-cp314-cp314-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl (639.7 kB view details)

Uploaded Aug 15, 2026 CPython 3.14manylinux: glibc 2.26+ x86-64manylinux: glibc 2.28+ x86-64

pcapy_ng-2.0.2-cp314-cp314-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl (621.4 kB view details)

Uploaded Aug 15, 2026 CPython 3.14manylinux: glibc 2.26+ ARM64manylinux: glibc 2.28+ ARM64

pcapy_ng-2.0.2-cp314-cp314-macosx_11_0_arm64.whl (64.6 kB view details)

Uploaded Aug 15, 2026 CPython 3.14macOS 11.0+ ARM64

pcapy_ng-2.0.2-cp314-cp314-macosx_10_15_x86_64.whl (64.5 kB view details)

Uploaded Aug 15, 2026 CPython 3.14macOS 10.15+ x86-64

pcapy_ng-2.0.2-cp313-cp313-musllinux_1_2_x86_64.whl (1.3 MB view details)

Uploaded Aug 15, 2026 CPython 3.13musllinux: musl 1.2+ x86-64

pcapy_ng-2.0.2-cp313-cp313-musllinux_1_2_aarch64.whl (1.2 MB view details)

Uploaded Aug 15, 2026 CPython 3.13musllinux: musl 1.2+ ARM64

pcapy_ng-2.0.2-cp313-cp313-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl (639.2 kB view details)

Uploaded Aug 15, 2026 CPython 3.13manylinux: glibc 2.26+ x86-64manylinux: glibc 2.28+ x86-64

pcapy_ng-2.0.2-cp313-cp313-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl (621.0 kB view details)

Uploaded Aug 15, 2026 CPython 3.13manylinux: glibc 2.26+ ARM64manylinux: glibc 2.28+ ARM64

pcapy_ng-2.0.2-cp313-cp313-macosx_11_0_arm64.whl (64.6 kB view details)

Uploaded Aug 15, 2026 CPython 3.13macOS 11.0+ ARM64

pcapy_ng-2.0.2-cp313-cp313-macosx_10_13_x86_64.whl (64.5 kB view details)

Uploaded Aug 15, 2026 CPython 3.13macOS 10.13+ x86-64

pcapy_ng-2.0.2-cp312-cp312-musllinux_1_2_x86_64.whl (1.3 MB view details)

Uploaded Aug 15, 2026 CPython 3.12musllinux: musl 1.2+ x86-64

pcapy_ng-2.0.2-cp312-cp312-musllinux_1_2_aarch64.whl (1.2 MB view details)

Uploaded Aug 15, 2026 CPython 3.12musllinux: musl 1.2+ ARM64

pcapy_ng-2.0.2-cp312-cp312-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl (633.5 kB view details)

Uploaded Aug 15, 2026 CPython 3.12manylinux: glibc 2.26+ x86-64manylinux: glibc 2.28+ x86-64

pcapy_ng-2.0.2-cp312-cp312-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl (615.4 kB view details)

Uploaded Aug 15, 2026 CPython 3.12manylinux: glibc 2.26+ ARM64manylinux: glibc 2.28+ ARM64

pcapy_ng-2.0.2-cp312-cp312-macosx_11_0_arm64.whl (64.6 kB view details)

Uploaded Aug 15, 2026 CPython 3.12macOS 11.0+ ARM64

pcapy_ng-2.0.2-cp312-cp312-macosx_10_13_x86_64.whl (64.5 kB view details)

Uploaded Aug 15, 2026 CPython 3.12macOS 10.13+ x86-64

pcapy_ng-2.0.2-cp311-cp311-musllinux_1_2_x86_64.whl (1.3 MB view details)

Uploaded Aug 15, 2026 CPython 3.11musllinux: musl 1.2+ x86-64

pcapy_ng-2.0.2-cp311-cp311-musllinux_1_2_aarch64.whl (1.2 MB view details)

Uploaded Aug 15, 2026 CPython 3.11musllinux: musl 1.2+ ARM64

pcapy_ng-2.0.2-cp311-cp311-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl (631.4 kB view details)

Uploaded Aug 15, 2026 CPython 3.11manylinux: glibc 2.26+ x86-64manylinux: glibc 2.28+ x86-64

pcapy_ng-2.0.2-cp311-cp311-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl (613.4 kB view details)

Uploaded Aug 15, 2026 CPython 3.11manylinux: glibc 2.26+ ARM64manylinux: glibc 2.28+ ARM64

pcapy_ng-2.0.2-cp311-cp311-macosx_11_0_arm64.whl (64.5 kB view details)

Uploaded Aug 15, 2026 CPython 3.11macOS 11.0+ ARM64

pcapy_ng-2.0.2-cp311-cp311-macosx_10_9_x86_64.whl (64.2 kB view details)

Uploaded Aug 15, 2026 CPython 3.11macOS 10.9+ x86-64

pcapy_ng-2.0.2-cp310-cp310-musllinux_1_2_x86_64.whl (1.3 MB view details)

Uploaded Aug 15, 2026 CPython 3.10musllinux: musl 1.2+ x86-64

pcapy_ng-2.0.2-cp310-cp310-musllinux_1_2_aarch64.whl (1.2 MB view details)

Uploaded Aug 15, 2026 CPython 3.10musllinux: musl 1.2+ ARM64

pcapy_ng-2.0.2-cp310-cp310-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl (629.7 kB view details)

Uploaded Aug 15, 2026 CPython 3.10manylinux: glibc 2.26+ x86-64manylinux: glibc 2.28+ x86-64

pcapy_ng-2.0.2-cp310-cp310-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl (611.8 kB view details)

Uploaded Aug 15, 2026 CPython 3.10manylinux: glibc 2.26+ ARM64manylinux: glibc 2.28+ ARM64

pcapy_ng-2.0.2-cp310-cp310-macosx_11_0_arm64.whl (64.5 kB view details)

Uploaded Aug 15, 2026 CPython 3.10macOS 11.0+ ARM64

pcapy_ng-2.0.2-cp310-cp310-macosx_10_9_x86_64.whl (64.2 kB view details)

Uploaded Aug 15, 2026 CPython 3.10macOS 10.9+ x86-64

pcapy_ng-2.0.2-cp39-cp39-musllinux_1_2_x86_64.whl (1.3 MB view details)

Uploaded Aug 15, 2026 CPython 3.9musllinux: musl 1.2+ x86-64

pcapy_ng-2.0.2-cp39-cp39-musllinux_1_2_aarch64.whl (1.2 MB view details)

Uploaded Aug 15, 2026 CPython 3.9musllinux: musl 1.2+ ARM64

pcapy_ng-2.0.2-cp39-cp39-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl (629.2 kB view details)

Uploaded Aug 15, 2026 CPython 3.9manylinux: glibc 2.26+ x86-64manylinux: glibc 2.28+ x86-64

pcapy_ng-2.0.2-cp39-cp39-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl (611.3 kB view details)

Uploaded Aug 15, 2026 CPython 3.9manylinux: glibc 2.26+ ARM64manylinux: glibc 2.28+ ARM64

pcapy_ng-2.0.2-cp39-cp39-macosx_11_0_arm64.whl (64.5 kB view details)

Uploaded Aug 15, 2026 CPython 3.9macOS 11.0+ ARM64

pcapy_ng-2.0.2-cp39-cp39-macosx_10_9_x86_64.whl (64.2 kB view details)

Uploaded Aug 15, 2026 CPython 3.9macOS 10.9+ x86-64

File details

Details for the file pcapy_ng-2.0.2.tar.gz.

File metadata

Download URL: pcapy_ng-2.0.2.tar.gz
Upload date: Aug 15, 2026
Size: 80.0 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for pcapy_ng-2.0.2.tar.gz
Algorithm	Hash digest
SHA256	`4cf43c4f09ccc6b40829cc44193011e620100e109acdd3cc0154451655f3e36e`
MD5	`05d269c582ef1d410cec10cbd68d8cbe`
BLAKE2b-256	`35617299ebb72ddaa6e62bb75597240b67d27ac00f08784ccddc41c1dfb0827e`

Algorithm	Hash digest
SHA256	`6764a010325013ecdc9f0640a8c91a87fc349feca43fd7af69d26b2a005a0045`
MD5	`d713cb2b8d96839ebd5f9a911f9cc106`
BLAKE2b-256	`104ae7854fbfcff7455b1429fb71c827b48b07eb8fb7bf5995e503fcd21fef36`

Algorithm	Hash digest
SHA256	`b1d19af146a7aa57b6b4f4a60a7817a14f06e642ca43d396ade60845035a6a2a`
MD5	`cdcc87d3f35368a4b70a7f6151fa8901`
BLAKE2b-256	`3d02071f62218b5c95125dfd33ee226a86148aac0bd3538b8e5976ffbabe7e10`

Algorithm	Hash digest
SHA256	`c16d1037187af0798ea8eafb9039b0c3d545fa9b8044777b26122e294a45915c`
MD5	`6be65284758ab041d882c3203f3bffe5`
BLAKE2b-256	`3c425d23afe0a9cee79fe2dccf457683bb525f0b85c91ff943f201cbea17e792`

Algorithm	Hash digest
SHA256	`4a5cb3e4b3e9e0c5e65a8290c7165542a3be670bb92cb6f690e6ee71a393b853`
MD5	`3e9e9723f5f1739e1c93675578a675a3`
BLAKE2b-256	`4ab3479501a40ed0949465d5f0ee06e68ec312bd9bae32bcff6039f0d8986e98`

Algorithm	Hash digest
SHA256	`68388f9354de9ab8159494b3b69a5df119bfc2b978ecd3ca2f71148af50382c1`
MD5	`2e74726fa650aa4fcba82832f9835090`
BLAKE2b-256	`efe38793a1e65eb5938c3eff79a9a6705c0c9c7be63c03dd7a1187cd813fd2db`

Algorithm	Hash digest
SHA256	`dda1f35b08e350288f4416a0a69d0448e640df50dae2c78d5319d94d46db2876`
MD5	`50edf38952241803d050810b52618802`
BLAKE2b-256	`b05979a63d43c5c0c6ac7111c82dd1d3d6b9d69274df6097b7f5f4c344dfa076`

Algorithm	Hash digest
SHA256	`0326a8d160a67a22bc2ce8b5f90a5c0bd9ab29884be20a2173544c4075c1ee97`
MD5	`8593a11ccff9e2eea6fbad5d2d376b64`
BLAKE2b-256	`d33672730c37d7c02a923844788013dbdc5cf197170c4bd9019e6b872d2ab9c2`

Algorithm	Hash digest
SHA256	`155286f098b2f9a67caad07888e885ad1ace29b0313d663a7704532c70c4e5d2`
MD5	`26a00a00aba1293ded9628885e50b0b7`
BLAKE2b-256	`eb6f10daa715e8e2bf8bbfc3a27f1eea34f73b9786f9cc6ac97295cbe0b827ab`

Algorithm	Hash digest
SHA256	`74182e32a36fda0ed5257b9e547a6abf08f660f36edd6939ce23792ade82c65d`
MD5	`1436dc49b522c391e066dfc46296de1f`
BLAKE2b-256	`c2bb74ae8785177e5399f289ba4feade0fc424f3129c212d9d6128bb7ebc72fe`

Algorithm	Hash digest
SHA256	`2ead4f8e0df930f209314901b01dca669d68afb2c37e30cd3526c45a467a7dba`
MD5	`ef95c55eac858db694e25fd874179edf`
BLAKE2b-256	`6d4ae6f0b322a8f7ca11f85cd1859d9cebfac51597ec558cf1088b8e3e443944`

Algorithm	Hash digest
SHA256	`7bf68e7dcbf8346b063a4dfa81c107cb66ac04ed16faa931d230311ff7687d75`
MD5	`402365c210892af752e9f4b83e9f85c6`
BLAKE2b-256	`c076ce6a44bb60be4bc871d17c3c9c0a2d7d6d638a78544af96dfe2204926bee`

Algorithm	Hash digest
SHA256	`bc5cb442dd6af99853b3c9d9af98af24a45c9a90a9bf695972779738ea370680`
MD5	`9579cce6ff132725668d62395a521e16`
BLAKE2b-256	`653637f2d0129a3cfb76c1ad520a94eaf15ea6cd5c49bdb7f3dc34af7c3743ff`

Algorithm	Hash digest
SHA256	`1f25a654e528c673782ae062bc444b59b313d9706e48f210363d1a3b59e9e561`
MD5	`5903b379e2709ea7345d5dd4f4059662`
BLAKE2b-256	`78d0e7b42681bbe10111c5d9caccf7c5ebb3c0965736994881515df11adaf9d4`

Algorithm	Hash digest
SHA256	`e383cbd1f5773d6d053ffcdc4424c4cab2129c0ece65ca49afb56e3c37d4035b`
MD5	`fcb1b059ea24f286aa43495c880a940c`
BLAKE2b-256	`21702054b3bb33e4b1f75aa241fe8108648d3670bd7cf4bcf0e4c6c459c0a6dd`

Algorithm	Hash digest
SHA256	`1ddec964b1f2b55ef19ab00a3027b0309446858a939fa8984b863c992af2d97b`
MD5	`34fcd32f941d8ab5d794f1a8069366a2`
BLAKE2b-256	`76d779af5c24fa0a4252f96e8a96b44f70409de2963d6195ae2ced46c4f65514`

Algorithm	Hash digest
SHA256	`a2d5ce15757c985f0fe1384608564055d97e489b6e5df0f0b89a683150c876e4`
MD5	`02ec7c3276e7acdd8be9ec9a4e4b5485`
BLAKE2b-256	`72f5e088f68354d703e8e77339c2e65779821dd9773b9613e91eed5433fbeec8`

Algorithm	Hash digest
SHA256	`6bb19d77488798f5a1a4755a944b3ef50d2bc991eb9e9d41d9d870896772a09e`
MD5	`9dc61b9ea5464971c6815b96a173bdb0`
BLAKE2b-256	`d39323c6c9eea87d83f2eba1bb9484915f521f82d87d21877ff79680a1e64235`

Algorithm	Hash digest
SHA256	`cb85c17be1c56251d69c39b89e2e1fa04b214f269c4bfbf653f4e7ad9ac326d5`
MD5	`b99e7a6ee2fa6f054a3ce0deac2223eb`
BLAKE2b-256	`b65139e02d930511961a1649ff576bd33509f9fb83f400cdc378e2d4b59b8c88`

Algorithm	Hash digest
SHA256	`6ecd84e403f80710e3f8b3b40f35b7c4c2a5d5f4714213d60edc9beac57782ae`
MD5	`b2f791626da402e7a19443e94d47b207`
BLAKE2b-256	`4ac928a21b625073380ff57610b335c2492de24572c4460b136151effe8b957a`

Algorithm	Hash digest
SHA256	`fcfe3105ea48c5b281836234a2eb36702de98e5c7a7002f3ddaf0bd3606019ee`
MD5	`5742571f36e0cdf41de28a4f39224244`
BLAKE2b-256	`c22e70799065b98e14e3db7a4f42e0c3e0a83a71d23431befb88b1e55fa541e1`

pcapy-ng 2.0.2

What is Pcapy-NG?

Contents

Install

Quick start

loop_filtered: filtering in C

Why not just a BPF filter?

Classes and the admit mask

Flow heads: the start of every connection

Address-set matching

loop_to_buffer: filling a shared buffer

Live counters and non-Ethernet links

Built-in security profile

next_batch: many packets per call

set_fanout: several handles on one interface

API reference

Examples

Building & compatibility

License & credits

Project links

Key dates

1 maintainer

Credits

GitHub Statistics

License

Requires

Tags

Classifiers

Download files

Source Distribution

Built Distributions

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

`loop_filtered`: filtering in C

`loop_to_buffer`: filling a shared buffer

`next_batch`: many packets per call

`set_fanout`: several handles on one interface

Algorithm	Hash digest
SHA256	`23a7c1b08f6a46c5ebfcca26cf7769d518b43e52e9e4972f8e6314397974d37d`
MD5	`c982016fed446928845081969c063774`
BLAKE2b-256	`f15ed31c597950e6e86591928187299e3c0045e75a5ed0700ee22eec07966ed3`

Algorithm	Hash digest
SHA256	`21b161a0435335db5bc04be36401fbc5edd0fccaaf50b8eff3742c5db4cc0c84`
MD5	`09ec297290e10f02cb0f61793c4b6b93`
BLAKE2b-256	`a5e984a46f56a9bfaead69496cbf3e5e569e143506cfbe45ce56df5b712b01a5`

Algorithm	Hash digest
SHA256	`cfd32da86bbea3242f28337368431794f31a6037050a6ab6a5be045b6318d92e`
MD5	`6a63c8cd3b01e0e51efe92c95ca94b42`
BLAKE2b-256	`a0c32c3df3831630a051ee06a44414af7085e87c60bbd78cf1f3bf854c9f125a`

Algorithm	Hash digest
SHA256	`be94d3564f5b02a881ca4fe39f6e43bbf435533c5777c0801a24bf27d2854075`
MD5	`ab8303860494e35c4078ec712008fc2d`
BLAKE2b-256	`eeea803496ed6217500c82d5d9270b09df52b0d2faef6f0f81903dee9813e6cc`

Algorithm	Hash digest
SHA256	`e0854bb09371d03650de5d9815b9c519de16576c6f40fb6e2bc4bd3bb3ce90e6`
MD5	`e7b5be1190b26a7fd74c14328ed0875a`
BLAKE2b-256	`e0ca04a97cecf3940ebb511098313531c1fb98bf3282d1900c1af954af5e20d2`

Algorithm	Hash digest
SHA256	`aad6c2fd2e853104285d29d469ea5543cb80c08bf8f7ce0f21d4eef37d659541`
MD5	`6f7036185a7beb2270231c5051a334fd`
BLAKE2b-256	`8ba8b2dd69e85fc9e72761c12398817058a4a6e095ba17487ef8856f30ae3355`

Algorithm	Hash digest
SHA256	`d40c04dd185bba01194f86029992db8947786f6af5baa21bff247524c56f3ded`
MD5	`dc3b32493cd2d68ed5b8b79d8371df34`
BLAKE2b-256	`88ee9e9b2a63744495aa8c6f50e2c235b766877d4f35cc3d05a307bdd813ce36`

Algorithm	Hash digest
SHA256	`3d0d224108324a55e75044c02e880a2293a24784f995a163569667ae6ef31ffd`
MD5	`dc5471f67d037a8e51a9f3fbfd001b5f`
BLAKE2b-256	`f6cfbe9d9357b52b3aa390830d25afd82759976898679d73549809aa8881083b`

Algorithm	Hash digest
SHA256	`83f1f912e4c49f2ee1f5f4927cae9714550fc955dcdd050256013cbdab1278c6`
MD5	`4f7801673293f772d1b8a86cde843c70`
BLAKE2b-256	`38241f16df29cf5cfe8a7316597c5266a24626baa2016ffc95666508655ef871`

Algorithm	Hash digest
SHA256	`d356294cb5dd8fc5775fdb6c9b2123c09628974d6324a77d1591a6e691d20164`
MD5	`26cc4057be99d4d7a8da2446a1d94d40`
BLAKE2b-256	`c4ac98b67d21e1934ddef2093bc70a3e28d55272728a0d32918269f7118f88ad`