Libtins – High-level and multiplatform C++ network packet sniffing and crafting • Hacker News Board

Re: Libtins – High-level and multiplatform C++ network packet sniffing and crafting

#21

Post by vram22 » Sat, May 27, 2017, 10:33 PM UTC

jcul wrote: post #20

vram22 wrote: post #19

Somewhat related: pcapy is a useful Python library for network packet handling. We used it recently in a project after evaluating it and a few others (not very thoroughly, though). dpkt is useful too. pcapy can read from a live stream or from a packet capture file (.pcap format).

I've found pyshark to be great too, especially for reading from a pcap. Scapy is great but has too many performance issues.

Thanks, will check out pyshark. I read the same about scapy somewhere, otherwise its interface seemed good (on only a little trying).

Re: Libtins – High-level and multiplatform C++ network packet sniffing and crafting

#22

Post by jcul » Mon, May 29, 2017, 7:36 AM UTC

jzwinck wrote: post #6

The linked page says "High level != inefficient" and shows an example program which will print "every TCP packet". With no "if" anywhere in the code, I wondered how it knew to print only TCP packets and not others. And the answer turns out to be that it throws a C++ exception on every non-TCP packet! If most of the packets on your network are TCP, this is sort of OK. But if you have mostly non-TCP packets, this toy p…

It seems there is an rfind_pdu returning a reference and throwing if the PDU is not present, or a find_pdu returning a pointer which you can just test for null.

Re: Libtins – High-level and multiplatform C++ network packet sniffing and crafting

#23

Post by pea-tear » Wed, May 31, 2017, 3:41 AM UTC

jzwinck wrote: post #6

The linked page says "High level != inefficient" and shows an example program which will print "every TCP packet". With no "if" anywhere in the code, I wondered how it knew to print only TCP packets and not others. And the answer turns out to be that it throws a C++ exception on every non-TCP packet! If most of the packets on your network are TCP, this is sort of OK. But if you have mostly non-TCP packets, this toy p…

Developer here. There's alternatives that don't throw but the example is mostly so people look at it and say "ah, cool, this is actually simple to use". I normally still use this throw-version of doing things when I just need to quickly do something, as in reality in most cases I don't care about performance for specific 10 line code snippets.

If you want to do things right, you can read the docs and use the appropriate API call (like using the non throwing PDU::find_pdu, use bpf filters, etc).