Libpcap wrapper

Error on running classic example

I'm getting an IllegalArgumentException on running the classic example for pcap.It says " size of array must be MAX_ID_COUNT size"

code :

//package org.jnetpcap.examples;
import java.util.ArrayList;
import java.util.Date;
import java.util.List;

import org.jnetpcap.Pcap;
import org.jnetpcap.PcapIf;
import org.jnetpcap.packet.JMemoryPacket;
import org.jnetpcap.packet.JPacket;
import org.jnetpcap.packet.PcapPacket;
import org.jnetpcap.packet.PcapPacketHandler;
import org.jnetpcap.protocol.JProtocol;
import org.jnetpcap.protocol.lan.Ethernet;
import org.jnetpcap.protocol.tcpip.Tcp;

public class ClassicPcapExample{

* Main startup method
* @param args
* ignored
public static void main(String[] args) {
List alldevs = new ArrayList(); // Will be filled with NICs
StringBuilder errbuf = new StringBuilder(); // For any error msgs

* First get a list of devices on this system
int r = Pcap.findAllDevs(alldevs, errbuf);
if (r == Pcap.NOT_OK || alldevs.isEmpty()) {
System.err.printf("Can't read list of devices, error is %s", errbuf

System.out.println("Network devices found:");

int i = 0;
for (PcapIf device : alldevs) {
String description =
(device.getDescription() != null) ? device.getDescription()
: "No description available";
System.out.printf("#%d: %s [%s]\n", i++, device.getName(), description);

PcapIf device = alldevs.get(0); // We know we have atleast 1 device
.printf("\nChoosing '%s' on your behalf:\n",
(device.getDescription() != null) ? device.getDescription()
: device.getName());


Unable to get PcapPacket payload with jnetpcap-1.4.r1425-1

Hello Mark,
First of all, thanks a lot for your great job and for your great framework!
Your jnetpcap is greatest library to work with low-level network protocols.

I get one trouble during trying to work with newest release of the jnetpcap.
I will be very appreciate if you could help me.

Here is my code:

public class Tester {
public static void main(String[] args) {
File source = new File("test-pcap.cap");
StringBuilder errbuf = new StringBuilder();
Pcap pcap = Pcap.openOffline(source.getAbsolutePath(), errbuf);
if (pcap == null) {
System.out.println(String.format("Unable to parse pcap file by path '%s' due to unexpected exception!%n%s", source.getAbsolutePath(), errbuf.toString()));
try {
pcap.loop(Pcap.LOOP_INFINITE, new TestPacketHandler(), null);
} catch(Exception e) {
System.out.println(String.format("Unable to parse pcap file by path '%s' due to unexpected exception!", source.getAbsolutePath()));
} finally {

public class TestPacketHandler implements PcapPacketHandler {
private final Ip4 ip4 = new Ip4();
private final Tcp tcp = new Tcp();
private final Payload basePayload = new Payload();

public void nextPacket(PcapPacket pcapPacket, Object obj) {
if (!pcapPacket.hasHeader(ip4)) {
if (!pcapPacket.hasHeader(tcp)) {
if (tcp.getPayloadLength() > 0 && !pcapPacket.hasHeader(basePayload)) {
System.out.println("Invalid packet! No payload header detected, but TCP-PayloadLength = " + tcp.getPayloadLength());
System.out.println("Everything is OK.");

Getting BufferUnderflowException when working with truncated packets

A code which works with captures without truncation sends BufferUnderflowException in case of truncated packets

I saw that the subject already presents on the forum
"Still getting BufferUnderflowException when working with truncated packets"
( the discussion is locked, so I have started a new subject)

What is a current status of the problem. Is it possible to work with such captures files? and how?

possible bug? possible workaround getHardwareAddress

I am using version 1.4 of jnetpcap on a 64 bit version of ubuntu 12.04 server. When I run getHardwareAddress on a pcapIf instance I get the error

java: symbol lookup error: /usr/lib/ undefined symbol: mac_addr_dlpi

I found a another person that had this question, I am wondering if there is a work around or if this has been fixed.

If there is a fix please point me in the right direction, otherwise, I am trying to use this call because I have lot of interfaces that I am dealing with, I get packets from all of them and put them all together. But when it is time to send them back out, I do not know which pcapIf instance to send it out on. Is there some generic way to just send packets since they have mac, ip and port in them?


My Project

Hi, I worked on a project to redirect packets through virtual interfaces ;

I faced a problem with this code .. i could capture the data at the other end of the tunnel but without replying the ping request :
Ping gives timeout , but i can see it at the other end

here is the code :
* This class implements several codes
* 1 - define interfaces and select real and virtual one.
* 2 - Set filter to capture only data going from and to virtual interface.
* 3 - Forward the data from real to virtual interface and vice versa.
* @author Mahdy

class NewThread extends Thread {
static void copy(InputStream in, OutputStream out) throws IOException {
byte[] buf = new byte[8192];
int len = 0;
while ((len = != -1) {
out.write(buf, 0, len);
NewThread() {
// Create a new, second thread
System.out.println("Connection Thread");
start(); // Start the thread

// This is the entry point for the second thread.
public void run() {

ServerSocket ss = null;
try {
ss = new ServerSocket(1999);

Socket socket = new Socket();

socket = ss.accept();

InputStream in = null;

in = socket.getInputStream();

OutputStream out = null;

out = socket.getOutputStream();

copy(in, out);

}catch(IOException e){


public class Main {

public static void main(String[] args) throws InterruptedException, IOException {

new NewThread();
* Define the interfaces
List alldevs = new ArrayList(); // Will be filled with NICs
StringBuilder errbuf = new StringBuilder(); // For any error msgs

int r = Pcap.findAllDevs(alldevs, errbuf);
if (r == Pcap.NOT_OK || alldevs.isEmpty()) {

Syndicate content