Guides

Ch 3 - Packet Decoding

Staring with release jNetPcap version 1.2, we have a powerful packet decoding framework. A new java package org.jnetpcap.packet contains all the necessary classes and sub-packages for protocol definitions, packet API, formatting, and a low level scanner.

The framework is made up of 4 major parts. Each discussed in its own section.

  1. PcapPacket and JPacket classes - they are the entry point to the entire decoding packet API
  2. JScanner and JRegistry classes - these classes maintain a database of protocols and allow the packets to be decoded using native functions.
  3. org.jnetpcap.protocol package - contains all the protocol definitions, grouped by protocol suites or families, written in java. Each protocol is made up of a mandatory header declaration and several optional classes such as analyzers, utility classes, events and protocol specific exceptions.
  4. org.jnetpcap.packet.format package - provides formatters that can read in a decoded packet and produce textual output such as, a pretty plain-text dump of a packet or Xml output.