In order to design proper applications that rely on certain features of the API or do things a certain way, it is sometimes essential to know a little bit how things work underneath the hood.

As you may already know, jNetPcap utilizes some native platform capabilities behind the scenes. It is also limited by the capabilities and performance of the libpcap implementation on the underlying platform. These capabilities and performance may vary greatly depending on which platform the jNetPcap is used on. This is kind of a given with any multiplatform library, but I repeat it here none the less.

What jNetPcap strives to accomplish is to expose as much capabilities as possible at fastest possible speed. Here are some note worthy highlighs of the inovations of jNetPcap library:

• No packet data copies between native land and java land
• Packet scanner/decoder is implemented mostly in native code and utilizes native C structures for decoding header for all of the core protocols.
• The scanner and libpcap both use large preallocated working buffer to store packet data and decoded packet state.
• The all important JPacket.hasHeader() and JPacket.getHeader() methods are implemented extremely efficiently. The HasHeader() is a bitwise OR of a single integer, which can be done very efficiently in both native and java space. Since these checks are to be found everywhere, especially in main loops, this fact is very important to note.