April 2009

What platforms are currently supported?

The following operating systems are currently supported with the latest development jNetPcap release. The table below also lists the various hardware architectures and packaging options supported.


Operating SystemVersiontar/zipx86_32x86_64Packager
Windows XPSP1 or aboveXX
Windows VistaSP1 or aboveXX
Windows 7SP1 or aboveXXX
FreeBSD7.1,8.1XXX
Open Solaris2009XXX
Mac/OSX*


Note *: Mac/OSX support is currently under development.

The following Linux variant operating systems are supported. All linux systems can run on the "Generic Linux" tar distribution, even the ones that are not part of the list below as long as they meet the minimum "Linux Kernel" version level and minimum "libpcap" library version of 9.8 for pre jnetpcap 1.4 APIs and libpcap version 1.0.0 or above for jnetpcap 1.4.


[table=theme Linux Systems | Version | tar/zip | x86_32| x86_64 | Packager
Generic Linux | Kernel 2.6.18 or above | X | X | X |
Fedora Core | 8,9,10,11,12 | | X | X | rpm
Redhat Enterprise | 4,5 | X | X | | rpm
Debian | 5 | | X | X | deb
Ubuntu | 9 | | X | X | deb
OpenSUSE* | 11.3 | | X | X | rpm
CentOS | 5.2 | | | |

I can't read the list of devices on a linux based system

On unix based systems permissions work differently then on Microsoft windows based systems. You need to execute your program with "root" privilege in order to see it.

Secondly, also make sure to print out the error message return in the "errbuf" parameter you passed into Pcap.findAllDevs method. It should contain information about the cause of your problem.

error: can't read list of devices

Hi,

I'm using Debian Lenny. When i start my program this error occurs.
The same program runs with no errors on XP.
I already installed the deb package and imported the lib (/usr/share/java/jnetpcap-1.2.rc5.jar). Then
I set the "Native library location" to /usr/lib.
Maybe someone has an idea.

Edit: ok, problem solved! I have to start my programm as root. So I started eclipse as root Eye

Why is tcpdump (pcap) so slow ?

I'm doing some preliminary testing with tcpdump so that I can get a better understanding of how to use libpcap (through jNetPcap) before actually running a real test with jNetPcap. I'm sending four pings from one PC to another and capturing them on the receive side using "tcpdump 'icmp' ". This works but there's a delay of perhaps 15 seconds before tcpdump even shows the traffic. I suppose I can expect to see this same delay in jNetPcap ...right?

Why is there such a long delay ?

edited:
RESOLVED: Without the "-n" argument, tcpdump does a DNS lookup on incoming traffic. With the "-n" argument, tcpdump is fast !

Thank you!

Need help using jnetpcap.dll

I wanted to check jnetpcap for future use in a project. Unfortunately i can't manage to get anything running Sad
I get some UnsatisfiedLinkError:
Exception in thread "main" java.lang.UnsatisfiedLinkError: org.jnetpcap.PcapPktHdr.initIDs()V
at org.jnetpcap.PcapPktHdr.initIDs(Native Method)
at org.jnetpcap.PcapPktHdr.(Unknown Source)
at jnetPcapTest.Runner.main(Runner.java:15)

The problem is, whatever i try to solve this does not work. I tried
- using -Djava.library.path="correctpath" as VM argument
- placing .dll in several system folders
- placing .dll in several workspace folders
- (i am using eclipse) assigning native library location for the jar

I am running out of ideas.. and google also ^^

I think i am missing something very basic, but i don't get it..

Can't run ClassicPcapExample on Windows XP

I'm trying to run the ClassicPcapExample.java, but I can't seem to get it to run inside of Eclipse or from the command-line. I'm hoping it's something simple, but I can't figure it out yet Laughing out loud

Eclipse has been updated to the latest version, and I'm using Java 6 update 13.

I added the jnetpcap-1.2.rc5.jar file to the referenced libraries for my project, so it seems to build fine.

I also added the -Djava.library.path=C:\jnetpcap-1.2.rc5 to the VM arguments, and that fixed the link error. But, now when I try to run it I keep getting the following error.


java.lang.NoClassDefFoundError: examples/ClassicPcapExample
Caused by: java.lang.ClassNotFoundException: examples.ClassicPcapExample
at java.net.URLClassLoader$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at sun.misc.Launcher$AppClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClassInternal(Unknown Source)
Exception in thread "main"

Here is the source file that I'm currently using


package example;

import java.nio.ByteBuffer;
import java.util.ArrayList;
import java.util.Date;
import java.util.List;

import org.jnetpcap.Pcap;
import org.jnetpcap.PcapHandler;
import org.jnetpcap.PcapIf;

@SuppressWarnings("deprecation")
public class ClassicPcapExample {
public static void main(String[] args) {
List alldevs = new ArrayList(); // Will be filled with NICs
StringBuilder errbuf = new StringBuilder(); // For any error msgs

/********************************************
* First get a list of devices on this system
********************************************/
int r = Pcap.findAllDevs(alldevs, errbuf);
if (r == Pcap.NOT_OK || alldevs.isEmpty()) {

question: transport protocol from IP protocol field header

Hi Mark,

How do i get the 'transport protocol' (tcp, udp, icmp etc) from IP 'protocol field' header via the IP4 class ? Is it the proctol type() OR id(). If i get int id is fine or keyword like TCP, UDP etc is better..

Cheers and Thanks !

Need help running first sample file

I have just installed jNetPcap and am trying to get the "ClassicPcapExample.java" to run (RHEL Linux). I am new to Java; I have many years experience as a C/C++ Developer.

Here's what I did for the install:
1. Downloaded the RPM and installed it.
2. Verified that libpcap is installed; version 0.9.4 of libpcap.so is in /usr/lib/ (with usual softlinks).
3. > LD_LIBRARY_PATH=/usr/lib

Here's what I do to compile and run:

javac -classpath /usr/share/java/jnetpcap-1.2.rc5.jar:./  -Xlint:deprecation ClassicPcapExample.java

   ...this gives some warnings for PcapHandler but it does compile a .class file.


java -classpath /usr/share/java/jnetpcap-1.2.rc5.jar:./  ClassicPcapExample

    ...this gives java.lang.NoClassDefFoundError for ClassicPcapExample

What's going on ??

tcp class flagsCompactString() method question

Hi Mark,

Do we know what is returned by the tcp class method flagsCompactString() when "no" tcp flags (no flags at all) are set in the tcp packet headers? a null or an empty string "" ?

public java.lang.String flagsCompactString()

Cheers and Thanks for the GREAT package !!

Http reassembler failed to collect all payloads in some cases.

Thanks to Mark, after RC5 I do not need to reassemble packets myself, but it seems to have some rare problems when I handle Http packets.
Before RC4, every packet be received fully.
After RC5, some packets's payload is lost. There is still packet infomation printed out but there is no payload info although I'm sure there must be.

Here is my code.

RC5

HttpAnalyzer ha = JRegistry.getAnalyzer(HttpAnalyzer.class);
ha.add(new FarmHttpHandler());
pcap.loop(-1, JRegistry.getAnalyzer(JController.class), pcap);

RC4
JPacketHandler jph = new RawCatch();
pcap.loop(-1, jph, "");

1st packet received well.
RC5 prints this out

Http:  ******* Http offset=54 (0x36) length=308 protocol suite=TCP/IP
Http: 
Http:   RequestVersion = HTTP/1.1
Http:     ResponseCode = 200
Http:  ResponseCodeMsg = OK
Http:             Date = Sun, 26 Apr 2009 09:58:16 GMT
Http:     Content-Type = text/html
Http:       Connection = keep-alive
Http:    Cache-Control = no-cache, must-revalidate
Http: Content-Encoding = gzip
Http: 
Data:  ******* Payload offset=362 (0x16A) length=1144 
Data: 
016a: 61 0d 0a 1f  8b 08 00 00  00 00 00 00  03 0d 0a 31    a.............1
017a: 32 37 33 0d  0a a5 5b db  72 db 46 12  fd 15 97 1e    273...[.r.F.....
//omitted

In the 2nd packet and following.

Http:  ******* Http offset=54 (0x36) length=1452 protocol suite=TCP/IP
Http: 
Http: 

Http:  ******* Http offset=54 (0x36) length=1452 protocol suite=TCP/IP
Http: 
Http: 

Http:  ******* Http offset=54 (0x36) length=703 protocol suite=TCP/IP
Http: 
Http: 

Nothing?
Is there a mistake in my code? Or is it about Gzip Encoding?
The GZip Encoding data's length is more than 4k bytes.
By the way, Images/HTML reassembling works fine here.

Detailed output is in the attachment.

Thank you Mark~