libpcap

libpcap is a portable open source C/C++ library that provides a generic interface for packet capture. It allows applications to capture raw network packets from a live network interface or to read packets from saved capture files. It is the de facto standard library for packet capture on Unix-like systems and is widely used by network analysis tools such as tcpdump and Wireshark.

The library offers a consistent API for opening capture sources, applying filters, and processing packets. Typical operations include opening a capture device, starting a capture loop or dispatch, and delivering packets to a user-supplied callback. It supports Berkeley Packet Filter (BPF) filtering, enabling efficient selection of which packets to capture. It can also write captured packets to files and read from those files, and supports both the standard pcap file format and the modern pcap-ng format. In addition, libpcap provides facilities for packet injection on platforms that support it, and for determining the data link type of the capture, which is essential for interpreting packet headers.

Platform support and licensing: libpcap is cross-platform, running on many Unix-like operating systems, macOS, and Windows (via compatible ports such as WinPcap or Npcap). It is distributed under a BSD-style license, making it free to use in both open source and proprietary projects.

History and usage: libpcap originated with the tcpdump project and has been maintained as the foundation for packet capture in a wide range of networking tools. It remains a central component in network analysis and monitoring ecosystems.