Capturing network packets using jNetPcap API

In this article, I’ll show you how to capture the network packets using Java. While studying networking you might have come across different kinds of packets, their header formats, their fields etc. But ever thought how it would be to grab one of them and study ? If yes then read on…this article will gratify your eagerness.

Here i will be using jNetPcap library. It is an open source java library, used to capture and decode network packets. It uses native implementations to provide optimum packet decoding performance.

Dependencies

Before starting, you require the following two libraries

• WinPcap library, available here
• jNetPcap library, available here

Setting up the environment

1. Run and install the executable WinPcap
2. Place the jnetpcap.jar on your project’s classpath
3. Place the jnetpcap.dll in C:\Windows or C:\Windows\System32 directory

Capturing the packets

import java.util.ArrayList;
import java.util.List;
import java.util.Scanner;
import org.jnetpcap.Pcap;
import org.jnetpcap.PcapIf;
import org.jnetpcap.packet.PcapPacket;
import org.jnetpcap.packet.PcapPacketHandler;
import org.jnetpcap.protocol.network.Arp;

public class PacketCapturer {

    public static void main(String[] args) {
        try {
            // Will be filled with NICs
            List alldevs = new ArrayList();

            // For any error msgs
            StringBuilder errbuf = new StringBuilder();

            //Getting a list of devices
            int r = Pcap.findAllDevs(alldevs, errbuf);
            System.out.println(r);
            if (r != Pcap.OK) {
                System.err.printf("Can't read list of devices, error is %s", errbuf
                        .toString());
                return;
            }

            System.out.println("Network devices found:");
            int i = 0;
            for (PcapIf device : alldevs) {
                String description =
                        (device.getDescription() != null) ? device.getDescription()
                        : "No description available";
                System.out.printf("#%d: %s [%s]\n", i++, device.getName(), description);
            }
            System.out.println("choose the one device from above list of devices");
            int ch = new Scanner(System.in).nextInt();
            PcapIf device = alldevs.get(ch);

            int snaplen = 64 * 1024;           // Capture all packets, no trucation
            int flags = Pcap.MODE_PROMISCUOUS; // capture all packets
            int timeout = 10 * 1000;           // 10 seconds in millis

            //Open the selected device to capture packets
            Pcap pcap = Pcap.openLive(device.getName(), snaplen, flags, timeout, errbuf);

            if (pcap == null) {
                System.err.printf("Error while opening device for capture: "
                        + errbuf.toString());
                return;
            }
            System.out.println("device opened");

            //Create packet handler which will receive packets
            PcapPacketHandler jpacketHandler = new PcapPacketHandler() {
                Arp arp = new Arp();

                @Override
                public void nextPacket(PcapPacket packet, String user) {
                    //Here i am capturing the ARP packets only,you can capture any packet that you want by just changing the below if condition
                    if (packet.hasHeader(arp)) {
                        System.out.println("Hardware type" + arp.hardwareType());
                        System.out.println("Protocol type" + arp.protocolType());
                        System.out.println("Packet:" + arp.getPacket());
                        System.out.println();
                    }
                }
            };
            //we enter the loop and capture the 10 packets here.You can  capture any number of packets just by changing the first argument to pcap.loop() function below
            pcap.loop(10, jpacketHandler, "jnetpcap rocks!");
            //Close the pcap
            pcap.close();
        } catch (Exception ex) {
            System.out.println(ex);
        }
    }
}

In the above program ,statement at line 21 will capture all the network interface devices available on your system.Then you have to choose the one amongst the available interface device. Then at line 46 the openLive() is used to obtain a packet capture descriptor to look at packets on the network.

It takes five parameters

1. device – buffer containing the name of the device
2. snaplen – amount of data to capture per packet
3. promisc – 1 means open in promiscious mode, 0 means non-propmiscous
4. timeout – timeout in ms
5. errbuf – a buffer that will contain any error messages if the call to open failed

Then at line 46, we create PacketHandler that gets notified when a new packet has been captured. And finally at line 71, we enter a loop which collects a specified number of packets and takes as argument,number of packets to capture,the user specified packet handler (jpacketHandler here in our programm) and any user defined data type (i.e a custom opaque user object ). Inside packet handler we check whether the packet contains the particular header of our interest and if it do so, display the packet.