jNetPcap SDK

Java's most powerful packet capture and protocol analysis library.

jNetPcap SDK provides high-performance network packet capture and deep protocol dissection for Java applications. Built on Java 22+ Foreign Function & Memory API for native libpcap access with zero-copy performance.

What's New in Version 3.0

jNetPcap 3.0 is a complete rewrite bringing modern Java capabilities:

Java 22+ with Panama FFM — Native libpcap access without JNI
Zero-allocation capture — Pre-allocated headers for 100M+ packets/second
Modular architecture — Pick only the protocol packs you need
Apache 2.0 open source — All modules now fully open source
Simplified API — PacketSettings replaces complex configuration

Quick Start

Maven

<dependency> <groupId>com.slytechs.sdk</groupId> <artifactId>jnetpcap-sdk</artifactId> <version>3.0.0-SNAPSHOT</version></dependency>

For SNAPSHOT versions, add the Sonatype repository:

<repositories> <repository> <id>sonatype-snapshots</id> <url>https://central.sonatype.com/repository/maven-snapshots/</url> <snapshots><enabled>true</enabled></snapshots> </repository></repositories>

Hello World

import com.slytechs.jnet.jnetpcap.api.NetPcap;import com.slytechs.sdk.protocol.tcpip.ip.Ip4;import com.slytechs.sdk.protocol.tcpip.tcp.Tcp;
public class HelloCapture { public static void main(String[] args) throws Exception { NetPcap.activateLicense(); // Free community license Ip4 ip4 = new Ip4(); Tcp tcp = new Tcp(); try (var pcap = NetPcap.openOffline("capture.pcap")) { pcap.loop(-1, packet -> { if (packet.hasHeader(ip4) && packet.hasHeader(tcp)) { System.out.printf("%s:%d → %s:%d%n", ip4.src(), tcp.srcPort(), ip4.dst(), tcp.dstPort()); } }); } }}

Run

java --enable-native-access=com.slytechs.sdk.jnetpcap,com.slytechs.sdk.common -jar myapp.jar

Features

Protocol Dissection

Automatic parsing of 50+ protocols across L2-L7:

Layer 2 — Ethernet, VLAN (802.1Q), MPLS, PPP, STP, LLDP
Layer 3 — IPv4, IPv6, ARP, ICMP, IPsec
Layer 4 — TCP, UDP, SCTP
Application — HTTP, TLS, DNS, QUIC (optional packs)

Zero-Allocation Processing

Headers are pre-allocated and rebound on each packet — no object creation in the hot path:

Ip4 ip = new Ip4(); // Allocate onceTcp tcp = new Tcp();
pcap.loop(-1, packet -> { if (packet.hasHeader(ip)) { // Binds ip to packet data if (packet.hasHeader(tcp)) { // Binds tcp to packet data // Process with zero allocation } }});

Packet Persistence

Keep packets beyond callback scope with explicit persistence:

Queue<Packet> queue = new ConcurrentLinkedQueue<>();
pcap.loop(-1, packet -> { if (interesting(packet)) { queue.add(packet.persist()); // Copy to independent memory }});
// Process laterPacket p;while ((p = queue.poll()) != null) { process(p); p.recycle();}

Memory Pools

High-volume capture with predictable memory usage:

Pool<Packet> pool = PacketPool.ofFixedSize( new PoolSettings().capacity(10000), 9000); // 9KB per packet
pcap.loop(-1, packet -> { if (interesting(packet) && pool.available() > 0) { queue.add(packet.persistTo(pool)); }});

SDK Modules

jnetpcap-sdk: Starter POM — pulls all dependencies
jnetpcap-api: High-level NetPcap API with dissection
jnetpcap-bindings: Low-level libpcap FFM bindings
sdk-common: Memory managment, pools, FFM and more
sdk-protocol-core: Protocol Header, Packet Dissection and Protocol Stack definitions
sdk-protocol-tcpip: Ethernet, IPv4/6, TCP, UDP, ICMP
sdk-protocol-web: HTTP, TLS, DNS, QUIC (optional)
sdk-protocol-infra: BGP, OSPF, STP, LLDP (optional)

License

jNetPcap SDK includes a free unlimited Community Edition license.

// Required once at application startupNetPcap.activateLicense();

Internet connectivity required for activation
No registration or API keys needed
Apache 2.0 with telemetry

For commercial licenses without telemetry, contact sales@slytechs.com.

Coming Soon: Version 3.1

Full Protocol Stack Processing (End of January 2026):

IP fragment reassembly
TCP stream reconstruction
Protocol state tracking
Advanced packet transformations