Welcome! You're looking at the manual for libnetdude. Thanks for reading this.
libnetdude is a library for manipulating libpcap/tcpdump tracefiles. You may ask why this requires a new library. We believe that a lot of code that uses libpcap is written redundantly because libpcap's API operates at a very low level: you get a means to obtain packets, and read them sequentially — that's it. Therefore, every developer out there that, say, wants to obtain the TCP header in a packet or fix an IP checksum needs to write his or her own code for that purpose. Moreover, the result is usually little helper tools that are never released to the public.
libnetdude's goal is to change this. It provides abstractions on top of the libpcap paradigm that save developers a lot of time by focusing on the relevant parts of their applications. Moreover, libnetdude supports plugins, dynamically loaded libraries, that can essentially do whatever the programmer desires. When developers write their packet manipulation code as libnetdude plugins, this instantly allows other developers to use their code.
libnetdude provides data types and APIs for the most common situations when dealing with libpcap trace files: trace files of arbitrary size, packets, network protocols, packet iterators, packet filters, just to name a few.
libnetdude allows the user to edit trace files in terms of trace areas, which are regions of packets in a trace file, defined by start- and end timestamps or size fractions. These areas can be conveniently iterated and modified, including insertion, modification, and deletion of packets. libnetdude takes care of managing the various areas, so that the user always sees a consistent view of the trace. libnetdude builds on the libpcapnav library in order to facilitate navigation in a trace file in time and space.
The rest of this document is structured as follows: the first chapter presents the main concepts of libnetdude. The second chapter explains the layout of the library's files on disk and how to build programs that use @lnd. The third chapter explains how to write a protocol plugin for the library, and the fourth explains how to write feature plugins. Code examples are not meant to be readily compilable when cut and pasted into a C file: variables are introduced when context requires them, and not all variables are meaningfully initialized. Admonitions in this manual have the following meaning:
![]() | Note: something you should be aware of. |
![]() | Caution: listen up, it's probably good for you. |
![]() | Warning: if you forget this, you'll be in trouble. |