Understand the different types of 802.11 frames and do something sensible with them.

node_pcap will not compile on cygwin as Windows has no similar implementation of the file descriptor (fd) and so Winpcap has no call pcap_get_selectable_fd(pcap_handle). Compiling fails due to this call not being present.

Open offline fails (Debian 7, Debian 6, node 0.8, node 0.10 ...).
As far I see pcap.open_offline gives back handle != NULL, which is good later on ins same binding function it seems to crash.

Sample program:
var pcap = require('pcap');
var session = pcap.createOfflineSession('test.pcap','');

Error:

/opt/pcaptest/pcaptest2/node_modules/pcap/pcap.js:50
me.link_type = me.session.open_offline(me.device_name, filter || "", m
^
Error: �e���
at Pcap.open (/opt/pcaptest/pcaptest2/node_modules/pcap/pcap.js:50:35)
at Object.exports.createOfflineSession (/opt/pcaptest/pcaptest2/node_modules/pcap/pcap.js:101:13)
at Object. (/opt/pcaptest/pcaptest2/test.js:2:20)
at Module._compile (module.js:456:26)
at Object.Module._extensions..js (module.js:474:10)
at Module.load (module.js:356:32)
at Function.Module._load (module.js:312:12)
at Function.Module.runMain (module.js:497:10)
at startup (node.js:119:16)
at node.js:901:3

sudo NODE_PATH=/usr/local/lib/node_modules/ node examples/simple_capture

node.js:181
throw e; // process.nextTick error, or 'error' event on first tick
^
Error: BIOCPROMISC: Invalid argument
at Pcap.open (/usr/local/lib/node_modules/pcap/pcap.js:44:34)
at Object.createSession (/usr/local/lib/node_modules/pcap/pcap.js:90:13)
at Object. (/Users/stephanepayrard/git/node_pcap/examples/simple_capture:17:21)
at Module._compile (module.js:420:26)
at Object..js (module.js:426:10)
at Module.load (module.js:336:31)
at Function._load (module.js:297:12)
at Array. (module.js:439:10)
at EventEmitter._tickCallback (node.js:173:26)

$ node -v
v0.6.2
$ node-waf configure build
Checking for program g++ or c++ : /usr/bin/g++
Checking for program cpp : /usr/bin/cpp
Checking for program ar : /usr/bin/ar
Checking for program ranlib : /usr/bin/ranlib
Checking for g++ : ok
Checking for node path : not found
Checking for node prefix : ok /usr
Checking for library pcap : yes
'configure' finished successfully (0.105s)
Waf: Entering directory /home/hans/node_modules/node_pcap/build' [1/2] cxx: pcap_binding.cc -> build/Release/pcap_binding_1.o ../pcap_binding.cc:2:25: fatal error: node_events.h: Datei oder Verzeichnis nicht gefunden compilation terminated. Waf: Leaving directory/home/hans/node_modules/node_pcap/build'
Build failed: -> task failed (err #1):
{task: cxx pcap_binding.cc -> pcap_binding_1.o}

npm looks the same. node_path? path? (what should be the content of?) libpcap is installed under /usr/include/pcap.

any ideas?
thanks a lot

When the response is delimited by the end of connection (i.e., they contain Connection: close, no Content-Length, no transfer-coding), a "http response complete" event needs to be generated.

Hi,

I did:

sudo apt-get install libpcap-dev
npm install pcap

then I created a file that looks like this:

var util = require('util'),
pcap = require('pcap'),
pcap_session = pcap.createSession('eth0', '');

pcap_session.on('packet', function (raw_packet) {
util.puts(raw_packet)
});

But when I try to run it I get:

Error: Cannot find module 'pcap'

I do get this though when running npm install:

Checking for node path : not found

f = function (raw_packet, offset) {
... return (
..... (raw_packet[offset] * 72057594037927936) +
..... (raw_packet[offset + 1] * 281474976710656) +
..... (raw_packet[offset + 2] * 1099511627776) +
..... (raw_packet[offset + 3] * 4294967296) +
..... (raw_packet[offset + 4] * 16777216) +
..... (raw_packet[offset + 5] * 65536) +
..... (raw_packet[offset + 6] * 256) +
..... raw_packet[offset + 7]
..... );
... }
[Function]

f([1,0,0,0,0,0,0,0], 0)
72057594037927940 # Wroang!

Is it possible to use node_pcap without running npm?
If I try npm install I only get:
npm ERR! Error: ETIMEDOUT, Connection timed out

I have cloned node_pcap and have run

egger>node-waf configure build
Checking for program g++ or c++ : /usr/bin/g++
Checking for program cpp : /usr/bin/cpp
Checking for program ar : /usr/bin/ar
Checking for program ranlib : /usr/bin/ranlib
Checking for g++ : ok
Checking for node path : ok /home/egger/xul-develop/workspace/node_pcap
Checking for node prefix : ok /usr/local
Checking for library pcap : yes
'configure' finished successfully (0.078s)
Waf: Entering directory /home/egger/xul-develop/workspace/testjs/node_modules/node_pcap/build' [1/2] cxx: pcap_binding.cc -> build/default/pcap_binding_1.o [2/2] cxx_link: build/default/pcap_binding_1.o -> build/default/pcap_binding.node Waf: Leaving directory/home/egger/xul-develop/workspace/testjs/node_modules/node_pcap/build'
'build' finished successfully (0.420s)

Then I have done

egger>ls
build changelog.md examples node_ko_article.md package.json pcap_binding.cc pcap.js README.md wscript
egger>sudo npm install .
npm info it worked if it ends with ok
npm info using [email protected]
npm info using [email protected]
npm ERR! sudon't!
npm ERR! sudon't! Running npm as root is not recommended!
npm ERR! sudon't! Seriously, don't do this!
npm ERR! sudon't!
npm info calculating sha1 /usr/lib/node/.npm/.cache/pcap/0.2.8/package.tgz
npm info shasum 5a3a7314fca559a842c3eaf2e78c6390e8f1840a
npm info preinstall [email protected]
npm info install [email protected]
Checking for program g++ or c++ : /usr/bin/g++
Checking for program cpp : /usr/bin/cpp
Checking for program ar : /usr/bin/ar
Checking for program ranlib : /usr/bin/ranlib
Checking for g++ : ok
Checking for node path : ok /home/egger/.node_libraries
Checking for node prefix : ok /usr/local
Checking for library pcap : yes
'configure' finished successfully (0.079s)
'clean' finished successfully (0.005s)
Waf: Entering directory /home/egger/xul-develop/workspace/testjs/node_modules/node_pcap/build' Waf: Leaving directory/home/egger/xul-develop/workspace/testjs/node_modules/node_pcap/build'
'build' finished successfully (0.004s)
npm info postinstall [email protected]
npm info predeactivate [email protected]
npm info deactivate [email protected]
npm info postdeactivate [email protected]
npm info preactivate [email protected]
npm info activate [email protected]
npm info postactivate [email protected]
npm info build Success: [email protected]
npm ok

egger>sudo find / -name pcap_binding.node
/usr/lib/node/.npm/pcap/0.2.8/package/build/default/pcap_binding.node
/usr/lib/node/.npm/.cache/pcap/0.2.8/package/build/default/pcap_binding.node

egger>sudo ./simple_capture

node.js:134
throw e; // process.nextTick error, or 'error' event on first tick
^
TypeError: pcap Open: expecting 3 arguments
at Pcap.open (/usr/lib/node/.npm/pcap/0.2.8/package/pcap.js:44:34)
at Object.createSession (/usr/lib/node/.npm/pcap/0.2.8/package/pcap.js:90:13)
at Object. (/home/egger/xul-develop/workspace/testjs/node_modules/node_pcap/examples/simple_capture:17:21)
at Module._compile (module.js:402:26)
at Object..js (module.js:408:10)
at Module.load (module.js:334:31)
at Function._load (module.js:293:12)
at Array. (module.js:421:10)
at EventEmitter._tickCallback (node.js:126:26)

did:

sudo apt-get install libpcap-dev
npm install pcap

then I created a file that looks like this:

var util = require('util'),
pcap = require('pcap'),
pcap_session = pcap.createSession('eth0', '');

pcap_session.on('packet', function (raw_packet) {
util.puts(raw_packet)
});

I'm getting an error whenever I try to use npm to install this. Any suggestions please?

Node v0.10.10
Ubuntu 12.10 (but I have exactly the same error on CentOS 6.2)

chris@chris-desktop:~/Node/Parser$ npm install pcap
npm http GET https://registry.npmjs.org/pcap
npm http 304 https://registry.npmjs.org/pcap
npm http GET https://registry.npmjs.org/socketwatcher
npm http 304 https://registry.npmjs.org/socketwatcher

[email protected] install /home/chris/node_modules/pcap/node_modules/socketwatcher
node-gyp rebuild
make: Entering directory /home/chris/node_modules/pcap/node_modules/socketwatcher/build' CXX(target) Release/obj.target/socketwatcher/socket_watcher.o SOLINK_MODULE(target) Release/obj.target/socketwatcher.node SOLINK_MODULE(target) Release/obj.target/socketwatcher.node: Finished COPY Release/socketwatcher.node make: Leaving directory/home/chris/node_modules/pcap/node_modules/socketwatcher/build'
[email protected] install /home/chris/node_modules/pcap
node-gyp rebuild
make: Entering directory /home/chris/node_modules/pcap/build' CXX(target) Release/obj.target/pcap_binding/pcap_binding.o CXX(target) Release/obj.target/pcap_binding/pcap_session.o ../pcap_session.cc: In static member function ‘static void PcapSession::PacketReady(u_char*, const pcap_pkthdr*, const u_char*)’: ../pcap_session.cc:72:50: error: ‘memcpy’ was not declared in this scope ../pcap_session.cc: In static member function ‘static v8::Handle<v8::Value> PcapSession::Open(bool, const v8::Arguments&)’: ../pcap_session.cc:202:50: error: ‘strlen’ was not declared in this scope make: *** [Release/obj.target/pcap_binding/pcap_session.o] Error 1 make: Leaving directory/home/chris/node_modules/pcap/build'
gyp ERR! build error
gyp ERR! stack Error: make failed with exit code: 2
gyp ERR! stack at ChildProcess.onExit (/usr/local/lib/node_modules/npm/node_modules/node-gyp/lib/build.js:267:23)
gyp ERR! stack at ChildProcess.EventEmitter.emit (events.js:98:17)
gyp ERR! stack at Process.ChildProcess._handle.onexit (child_process.js:789:12)
gyp ERR! System Linux 3.5.0-39-generic
gyp ERR! command "node" "/usr/local/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js" "rebuild"
gyp ERR! cwd /home/chris/node_modules/pcap
gyp ERR! node -v v0.10.10
gyp ERR! node-gyp -v v0.9.6
gyp ERR! not ok
npm ERR! weird error 1
npm ERR! not ok code 0

hi!

is it possible to send and monitor ping packets with this library?

thx, regards, dz

If I close a pcap session, it appears to not actually be closing - packets continue to be captured and callbacks fired. Test case here: https://gist.github.com/815123 (both session 1 and session 2 's callbacks are fired when this is run, both on 0.2.x and 0.3.8)

I would like to propose to make Pcap a readable stream. That way it could interface better with the streaming model node uses for basically all other i/o.
If there is support for this I might have a look at it.

Using: Windows 7
Platform: 32/64 bit both confirmed.
Command: npm install pcap -g, npm install pcap
Other things: Tried git pull and manual compilation, to no avail!

Console Output

C:\Users\jtenner\node_modules\pcap>node "C:\Program Files\nodejs\node_modules\np
m\bin\node-gyp-bin\\..\..\node_modules\node-gyp\bin\node-gyp.js" rebuild
Building the projects in this solution one at a time. To enable parallel build,
please add the "/m" switch.
  pcap_binding.cc
  pcap_session.cc
..\pcap_binding.cc(5): fatal error C1083: Cannot open include file: 'pcap/pcap.
h': No such file or directory [C:\Users\jtenner\node_modules\pcap\build\pcap_bi
nding.vcxproj]
..\pcap_session.cc(4): fatal error C1083: Cannot open include file: 'pcap/pcap.
h': No such file or directory [C:\Users\jtenner\node_modules\pcap\build\pcap_bi
nding.vcxproj]
gyp ERR! build error
gyp ERR! stack Error: `c:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
` failed with exit code: 1
gyp ERR! stack     at ChildProcess.onExit (C:\Program Files\nodejs\node_modules\
npm\node_modules\node-gyp\lib\build.js:267:23)
gyp ERR! stack     at ChildProcess.EventEmitter.emit (events.js:98:17)
gyp ERR! stack     at Process.ChildProcess._handle.onexit (child_process.js:789:
12)
gyp ERR! System Windows_NT 6.1.7601
gyp ERR! command "node" "C:\\Program Files\\nodejs\\node_modules\\npm\\node_modu
les\\node-gyp\\bin\\node-gyp.js" "rebuild"
gyp ERR! cwd C:\Users\jtenner\node_modules\pcap
gyp ERR! node -v v0.10.17
gyp ERR! node-gyp -v v0.10.9
gyp ERR! not ok
npm ERR! weird error 1
npm ERR! not ok code 0

Possible Conclusions...

Looks like it can't find a file it needs.

pcap/pcap.h header is indeed missing from the project. (I opened the folder and indeed it was not there.)

Would be more than great to see netflow support here. Maybe it's generally a good idea to use the wireshark/tshark dissectors for deep packet analyzing, like on netflow packets. :-)

hi~

i try test node_pcap module of node.js.

tcp_metrics sample run sometime crashed.

pcap.js 1408 line(session.http) is error occured.

==>
if (session.http.request) {
stats.http_request = session.http.request;
}

try debuging, that session is sometime not exist http object.

i think, this line is replaced.

==> if (session.http !== undefined) {
stats.http_request = session.http.request;
}

I am pretty confident that I have libpcap on my system, since it comes with OS X and I often use WireShark. And gcc can find pcap.h:

-- Verify g++ can find pcap.h:

$ g++ wally.c
$ g++ wally.c -include pcap.h
$ g++ wally.c -include pcapxxx.h
cc1plus: error: pcapxxx.h: No such file or directory

-- It's probably irrelevant, but 'npm install pcap' also complains about node_path, which also exists:

$ echo $NODE_PATH
/usr/local/lib/node_modules

--- 'npm install pcap' can't find either of them:

$ sudo npm install pcap
npm http GET https://registry.npmjs.org/pcap
npm http 304 https://registry.npmjs.org/pcap

[email protected] install /usr/local/lib/node_modules/pcap
node-waf configure clean build

Checking for program g++ or c++ : /usr/bin/g++
Checking for program cpp : /usr/bin/cpp
Checking for program ar : /usr/bin/ar
Checking for program ranlib : /usr/bin/ranlib
Checking for g++ : ok
Checking for node path : not found
Checking for node prefix : ok /usr/local
Checking for library pcap : not found
/usr/local/lib/node_modules/pcap/wscript:12: error: libpcap C library not found on this system.

--- Is it possible that this is related to the issue of using node_waf instead of node_gyp?

"If you have a native addon for node that still has a wscript file, then you should definitely add a binding.gyp file to support the latest versions of node." (https://github.com/TooTallNate/node-gyp/)

Selective ACK, or "SACK" is a more efficient optimization to TCP's ACK behavior that is carried in the TCP options header. Most modern operating systems support this, but not all have it enabled.

Without understanding it properly, ACK and retransmission timings won't be accurate.

I'd like to send raw ethernet frames. However, my C++/Node bindings knowledge is quite limited. How hard would it be to bridge pcap's send API?

Reference:
http://www.microhowto.info/howto/send_an_arbitrary_ethernet_frame_using_libpcap.html

Hi we are trying to use the node pcap library for a network visualization project.

We got the code to run under OSX but I am having difficulty getting it to run on a Ubuntu Server 13. When we execute an live capture it works, but loading a an existing file throws a cryptic error.

Anyone have a resolution?

CODE:
var pcap = require("pcap");
var pcap_session = pcap.createOfflineSession("data/eth1_eth2_20120204182604.pcap","");

ERROR:

/home/ubuntu/node_modules/pcap/pcap.js:50
me.link_type = me.session.open_offline(me.device_name, filter || "", m
^
Error: ����
at Pcap.open (/home/ubuntu/node_modules/pcap/pcap.js:50:35)
at Object.exports.createOfflineSession (/home/ubuntu/node_modules/pcap/pcap.js:101:13)
at Object. (/home/ubuntu/Dropbox/WWW/htdocs/cs284/test.js:3:26)
at Module._compile (module.js:456:26)
at Object.Module._extensions..js (module.js:474:10)
at Module.load (module.js:356:32)
at Function.Module._load (module.js:312:12)
at Function.Module.runMain (module.js:497:10)
at startup (node.js:119:16)
at node.js:901:3

I'm doing a source build on Mac OSX 10.6.6 and the latest Node.js, v 0.4.0-pre. Also get this error when doing a npm install pcap. Here's the output:

pmcfadin$ node-waf configure build
Checking for program g++ or c++ : /usr/bin/g++
Checking for program cpp : /usr/bin/cpp
Checking for program ar : /usr/bin/ar
Checking for program ranlib : /usr/bin/ranlib
Checking for g++ : ok
Checking for node path : not found
Checking for node prefix : ok /usr/local
Checking for library pcap : yes
'configure' finished successfully (0.857s)
Waf: Entering directory /Volumes/Data/node_pcap/build' [1/2] cxx: pcap_binding.cc -> build/default/pcap_binding_1.o ../pcap_binding.cc: In function ‘v8::Handle<v8::Value> Open(bool, const v8::Arguments&)’: ../pcap_binding.cc:141: error: ‘pcap_create’ was not declared in this scope ../pcap_binding.cc:147: error: ‘pcap_set_snaplen’ was not declared in this scope ../pcap_binding.cc:152: error: ‘pcap_set_promisc’ was not declared in this scope ../pcap_binding.cc:157: error: ‘pcap_set_buffer_size’ was not declared in this scope ../pcap_binding.cc:162: error: ‘pcap_set_timeout’ was not declared in this scope ../pcap_binding.cc:172: error: ‘pcap_activate’ was not declared in this scope Waf: Leaving directory/Volumes/Data/node_pcap/build'
Build failed: -> task failed (err #1):
{task: cxx pcap_binding.cc -> pcap_binding_1.o}

node -v: 0.6.7
npm install: [email protected]

The installation is going just fine, but running a script with pcap the first time i get the following error:

Error: Cannot find module './build/default/pcap_binding'

I noticed, that node-waf is compiling the pcap_binding.cc into the directory './build/Release' and not into './build/default'.
It couldn't fix it with the npm package, but after cloning the repository and changing the directory in 'pcap.js' i could start the script.

is there any way to prevent an HTTP response，or redirect,thanks.

I have a crazy idea for no good reason. Is it possible to get node_pcap to display pcap info to Meteor?

When trying to run pcap examples in v0.8.11, they print
"WARNING: don't use IOWatcher, it'll be removed in v0.9"
and immediately return without capturing any packets.

Apparently, IOWatcher is broken since 0.7.9
nodejs/node-v0.x-archive#4136

According to Ben Noordhuis, IOWatcher is deprecated and will be removed with no replacement.
https://groups.google.com/forum/?fromgroups=#!topic/nodejs/uIzIrSrmW7k

Description How to migrate from ev_io_* to uv_poll_* for IO polling
https://github.com/joyent/node/wiki/How-to-migrate-from-ev_io_*-to-uv_poll_*-for-IO-polling

Has anyone worked on this already? Thanks.

I tried submitting the bug to node directly but they call it expected behavior: nodejs/node-v0.x-archive#2235

I wanted to submit this as an issue to get any feedback on how best to implement the fix.

Not sure if this is something with my setup, but installation fails for me on Snow Leopard machine with the following message:

[1/2] cxx: pcap_binding.cc -> build/default/pcap_binding_1.o
../pcap_binding.cc:12:16: error: ev.h: No such file or directory
Waf: Leaving directory `/private/tmp/node_pcap/build'
Build failed: -> task failed (err #1):
{task: cxx pcap_binding.cc -> pcap_binding_1.o}

The fix is to change the include from 'ev.h' to 'ev/ev.h'

Running on ubuntu 12. Clearly needs:

apt-get install libpcap0.8-dev

But, alas.

npm install pcap

npm http GET https://registry.npmjs.org/pcap
npm http 304 https://registry.npmjs.org/pcap

[email protected] install /root/eh/node_modules/pcap
node-waf configure clean build

Checking for program g++ or c++ : /usr/bin/g++
Checking for program cpp : /usr/bin/cpp
Checking for program ar : /usr/bin/ar
Checking for program ranlib : /usr/bin/ranlib
Checking for g++ : ok
Checking for node path : not found
Checking for node prefix : ok /usr
Checking for library pcap : yes
'configure' finished successfully (0.135s)
'clean' finished successfully (0.004s)
Waf: Entering directory /root/eh/node_modules/pcap/build' [1/2] cxx: pcap_binding.cc -> build/Release/pcap_binding_1.o [2/2] cxx_link: build/Release/pcap_binding_1.o -> build/Release/pcap_binding.node Waf: Leaving directory/root/eh/node_modules/pcap/build'
'build' finished successfully (0.617s)
(cxx_link fails).

I've tried setting various values for NODE_PATH; nothing changes.

After successfully running against Node 0.3.2 for a few weeks, I'm now running into the following errors after upgrading to Node 0.3.2.

-> sudo node app.js
Password:
Listening on en1
dyld: lazy symbol binding failed: Symbol not found: __ZN4node6Buffer4DataEN2v86HandleINS1_6ObjectEEE
Referenced from: /usr/local/lib/node/.npm/pcap/0.2.6/package/build/default/pcap_binding.node
Expected in: flat namespace

dyld: Symbol not found: __ZN4node6Buffer4DataEN2v86HandleINS1_6ObjectEEE
Referenced from: /usr/local/lib/node/.npm/pcap/0.2.6/package/build/default/pcap_binding.node
Expected in: flat namespace

Trace/BPT trap

I'm getting this:

% node-waf configure build
Checking for program g++ or c++ : /usr/bin/g++
Checking for program cpp : /usr/bin/cpp
Checking for program ar : /usr/bin/ar
Checking for program ranlib : /usr/bin/ranlib
Checking for g++ : ok
Checking for node path : ok /usr/local/lib/node_modules
Checking for node prefix : ok /usr/local
Checking for library pcap : yes
'configure' finished successfully (0.134s)
Waf: Entering directory /Users/johngoulah/wdir/node_pcap/build' [1/2] cxx: pcap_binding.cc -> build/default/pcap_binding_1.o ../pcap_binding.cc:2:25: error: node_events.h: No such file or directory Waf: Leaving directory/Users/johngoulah/wdir/node_pcap/build'
Build failed: -> task failed (err #1):
{task: cxx pcap_binding.cc -> pcap_binding_1.o}

It doesn't seem that node has a node_events.h anymore?

http.response is initialised in the request's onMessageStart, which means that if two responses are received without an intervening HTTP request (e.g., when pipelining happens), the new one will overwrite the old one.

The patch below moves the init to the response's onMessageStart. That doesn't completely fix things, as someone accessing http.request from the response's context will get the wrong request. However, that's really a separate bug.

diff --git a/pcap.js b/pcap.js
index 5083d69..d69116c 100644
--- a/pcap.js
+++ b/pcap.js
@@ -1125,6 +1125,12 @@ TCP_tracker.prototype.setup_http_tracking = function (session) {
             body_len: 0,
             http_version: null
         };
+        http.response = {
+            headers: {},
+            status_code: null,
+            body_len: 0,
+            http_version: null
+        };

         http.request_parser.onURL = function (buf, start, len) {
             var url_string = buf.toString('ascii', start, start + len);
@@ -1181,13 +1187,6 @@ TCP_tracker.prototype.setup_http_tracking = function (session) {

     http.response_parser = new HTTPParser('response');
     http.response_parser.onMessageBegin = function () {
-        http.response = {
-            headers: {},
-            status_code: null,
-            body_len: 0,
-            http_version: null
-        };
-
         http.response_parser.onHeaderField = function (buf, start, len) {
             var field = buf.toString('ascii', start, start + len);
             if (http.response_parser.header_value) {

When trying to use session_stats for non-http packets,

1109 if (session.http.request) {
1110 stats.http_request = session.http.request;
1111 }

fails since http is undefined here. I've fixed it to something like

1109 if (session.http && session.http.request) {
1110 stats.http_request = session.http.request;
1111 }

and it worked after that.

On Leopard, I'm seeing this error

npm info it worked if it ends with ok
npm info version 0.2.0
npm info fetch http://registry.npmjs.org/pcap/-/pcap-0.2.1.tgz
npm info install [email protected]
npm WARN bins installing to /usr/local/share/npm/bin, outside PATH
npm info install [email protected]
Checking for program g++ or c++          : /usr/bin/g++ 
Checking for program cpp                 : /usr/bin/cpp 
Checking for program ar                  : /usr/bin/ar 
Checking for program ranlib              : /usr/bin/ranlib 
Checking for g++                         : ok  
Checking for node path                   : not found 
Checking for node prefix                 : ok /usr/local/Cellar/node/0.2.1 
'configure' finished successfully (0.806s)
Waf: Entering directory `/usr/local/lib/node/.npm/pcap/0.2.1/package/build'
[1/2] cxx: pcap_binding.cc -> build/default/pcap_binding_1.o
../pcap_binding.cc:5:23: error: pcap/pcap.h: No such file or directory
../pcap_binding.cc:22: error: aggregate ‘bpf_program fp’ has incomplete type and cannot be defined
../pcap_binding.cc:23: error: ‘bpf_u_int32’ does not name a type
../pcap_binding.cc:24: error: ‘bpf_u_int32’ does not name a type
../pcap_binding.cc:25: error: expected constructor, destructor, or type conversion before ‘*’ token
../pcap_binding.cc: In function ‘void PacketReady(u_char*, const pcap_pkthdr*, const u_char*)’:
../pcap_binding.cc:46: error: invalid use of undefined type ‘const struct pcap_pkthdr’
../pcap_binding.cc:40: error: forward declaration of ‘const struct pcap_pkthdr’
../pcap_binding.cc:52: error: invalid use of undefined type ‘const struct pcap_pkthdr’
../pcap_binding.cc:40: error: forward declaration of ‘const struct pcap_pkthdr’
../pcap_binding.cc:53: error: invalid use of undefined type ‘const struct pcap_pkthdr’
../pcap_binding.cc:40: error: forward declaration of ‘const struct pcap_pkthdr’
../pcap_binding.cc:54: error: invalid use of undefined type ‘const struct pcap_pkthdr’
../pcap_binding.cc:40: error: forward declaration of ‘const struct pcap_pkthdr’
../pcap_binding.cc:55: error: invalid use of undefined type ‘const struct pcap_pkthdr’
../pcap_binding.cc:40: error: forward declaration of ‘const struct pcap_pkthdr’
../pcap_binding.cc: In function ‘v8::Handle Dispatch(const v8::Arguments&)’:
../pcap_binding.cc:89: error: ‘pcap_handle’ was not declared in this scope
../pcap_binding.cc:89: error: ‘pcap_dispatch’ was not declared in this scope
../pcap_binding.cc: In function ‘v8::Handle Open(bool, const v8::Arguments&)’:
../pcap_binding.cc:100: error: ‘PCAP_ERRBUF_SIZE’ was not declared in this scope
../pcap_binding.cc:120: error: ‘net’ was not declared in this scope
../pcap_binding.cc:120: error: ‘mask’ was not declared in this scope
../pcap_binding.cc:120: error: ‘errbuf’ was not declared in this scope
../pcap_binding.cc:120: error: ‘pcap_lookupnet’ was not declared in this scope
../pcap_binding.cc:126: error: ‘pcap_handle’ was not declared in this scope
../pcap_binding.cc:126: error: ‘errbuf’ was not declared in this scope
../pcap_binding.cc:126: error: ‘pcap_create’ was not declared in this scope
../pcap_binding.cc:128: error: no matching function for call to ‘v8::String::New()’
/usr/local/Cellar/node/0.2.1/include/node/v8.h:1147: note: candidates are: static v8::Local v8::String::New(const char*, int)
/usr/local/Cellar/node/0.2.1/include/node/v8.h:1150: note:                 static v8::Local v8::String::New(const uint16_t*, int)
../pcap_binding.cc:132: error: ‘pcap_set_snaplen’ was not declared in this scope
../pcap_binding.cc:137: error: ‘pcap_set_promisc’ was not declared in this scope
../pcap_binding.cc:142: error: ‘pcap_set_buffer_size’ was not declared in this scope
../pcap_binding.cc:147: error: ‘pcap_set_timeout’ was not declared in this scope
../pcap_binding.cc:157: error: ‘pcap_activate’ was not declared in this scope
../pcap_binding.cc:158: error: ‘pcap_geterr’ was not declared in this scope
../pcap_binding.cc:162: error: ‘pcap_handle’ was not declared in this scope
../pcap_binding.cc:162: error: ‘errbuf’ was not declared in this scope
../pcap_binding.cc:162: error: ‘pcap_open_offline’ was not declared in this scope
../pcap_binding.cc:164: error: no matching function for call to ‘v8::String::New()’
/usr/local/Cellar/node/0.2.1/include/node/v8.h:1147: note: candidates are: static v8::Local v8::String::New(const char*, int)
/usr/local/Cellar/node/0.2.1/include/node/v8.h:1150: note:                 static v8::Local v8::String::New(const uint16_t*, int)
../pcap_binding.cc:168: error: ‘pcap_handle’ was not declared in this scope
../pcap_binding.cc:168: error: ‘errbuf’ was not declared in this scope
../pcap_binding.cc:168: error: ‘pcap_setnonblock’ was not declared in this scope
../pcap_binding.cc:169: error: no matching function for call to ‘v8::String::New()’
/usr/local/Cellar/node/0.2.1/include/node/v8.h:1147: note: candidates are: static v8::Local v8::String::New(const char*, int)
/usr/local/Cellar/node/0.2.1/include/node/v8.h:1150: note:                 static v8::Local v8::String::New(const uint16_t*, int)
../pcap_binding.cc:173: error: ‘pcap_handle’ was not declared in this scope
../pcap_binding.cc:173: error: ‘net’ was not declared in this scope
../pcap_binding.cc:173: error: ‘pcap_compile’ was not declared in this scope
../pcap_binding.cc:174: error: ‘pcap_geterr’ was not declared in this scope
../pcap_binding.cc:177: error: ‘pcap_handle’ was not declared in this scope
../pcap_binding.cc:177: error: ‘pcap_setfilter’ was not declared in this scope
../pcap_binding.cc:178: error: ‘pcap_geterr’ was not declared in this scope
../pcap_binding.cc:186: error: ‘pcap_handle’ was not declared in this scope
../pcap_binding.cc:186: error: ‘pcap_get_selectable_fd’ was not declared in this scope
../pcap_binding.cc:192: error: ‘pcap_datalink’ was not declared in this scope
../pcap_binding.cc:202: error: ‘DLT_IEEE802_11_RADIO’ was not declared in this scope
../pcap_binding.cc:209: error: ‘errbuf’ was not declared in this scope
../pcap_binding.cc:210: error: no matching function for call to ‘v8::String::New()’
/usr/local/Cellar/node/0.2.1/include/node/v8.h:1147: note: candidates are: static v8::Local v8::String::New(const char*, int)
/usr/local/Cellar/node/0.2.1/include/node/v8.h:1150: note:                 static v8::Local v8::String::New(const uint16_t*, int)
../pcap_binding.cc: In function ‘v8::Handle FindAllDevs(const v8::Arguments&)’:
../pcap_binding.cc:232: error: ‘PCAP_ERRBUF_SIZE’ was not declared in this scope
../pcap_binding.cc:233: error: ‘pcap_if_t’ was not declared in this scope
../pcap_binding.cc:233: error: ‘alldevs’ was not declared in this scope
../pcap_binding.cc:233: error: ‘cur_dev’ was not declared in this scope
../pcap_binding.cc:235: error: ‘errbuf’ was not declared in this scope
../pcap_binding.cc:235: error: ‘pcap_findalldevs’ was not declared in this scope
../pcap_binding.cc:236: error: no matching function for call to ‘v8::String::New()’
/usr/local/Cellar/node/0.2.1/include/node/v8.h:1147: note: candidates are: static v8::Local v8::String::New(const char*, int)
/usr/local/Cellar/node/0.2.1/include/node/v8.h:1150: note:                 static v8::Local v8::String::New(const uint16_t*, int)
../pcap_binding.cc:251: error: ‘pcap_addr_t’ was not declared in this scope
../pcap_binding.cc:251: error: ‘cur_addr’ was not declared in this scope
../pcap_binding.cc:277: error: ‘PCAP_IF_LOOPBACK’ was not declared in this scope
../pcap_binding.cc:284: error: ‘pcap_freealldevs’ was not declared in this scope
../pcap_binding.cc: In function ‘v8::Handle Close(const v8::Arguments&)’:
../pcap_binding.cc:293: error: ‘pcap_handle’ was not declared in this scope
../pcap_binding.cc:293: error: ‘pcap_close’ was not declared in this scope
../pcap_binding.cc: In function ‘v8::Handle Fileno(const v8::Arguments&)’:
../pcap_binding.cc:303: error: ‘pcap_handle’ was not declared in this scope
../pcap_binding.cc:303: error: ‘pcap_get_selectable_fd’ was not declared in this scope
../pcap_binding.cc: In function ‘v8::Handle Stats(const v8::Arguments&)’:
../pcap_binding.cc:313: error: aggregate ‘pcap_stat ps’ has incomplete type and cannot be defined
../pcap_binding.cc:315: error: ‘pcap_handle’ was not declared in this scope
../pcap_binding.cc:315: error: ‘pcap_stats’ was not declared in this scope
../pcap_binding.cc: In function ‘v8::Handle DefaultDevice(const v8::Arguments&)’:
../pcap_binding.cc:334: error: ‘PCAP_ERRBUF_SIZE’ was not declared in this scope
../pcap_binding.cc:339: error: ‘pcap_if_t’ was not declared in this scope
../pcap_binding.cc:339: error: ‘alldevs’ was not declared in this scope
../pcap_binding.cc:339: error: ‘dev’ was not declared in this scope
../pcap_binding.cc:340: error: ‘pcap_addr_t’ was not declared in this scope
../pcap_binding.cc:340: error: ‘addr’ was not declared in this scope
../pcap_binding.cc:343: error: ‘errbuf’ was not declared in this scope
../pcap_binding.cc:343: error: ‘pcap_findalldevs’ was not declared in this scope
../pcap_binding.cc:344: error: no matching function for call to ‘v8::String::New()’
/usr/local/Cellar/node/0.2.1/include/node/v8.h:1147: note: candidates are: static v8::Local v8::String::New(const char*, int)
/usr/local/Cellar/node/0.2.1/include/node/v8.h:1150: note:                 static v8::Local v8::String::New(const uint16_t*, int)
../pcap_binding.cc:348: error: ‘PCAP_IF_LOOPBACK’ was not declared in this scope
../pcap_binding.cc:363: error: ‘pcap_freealldevs’ was not declared in this scope
../pcap_binding.cc: In function ‘v8::Handle LibVersion(const v8::Arguments&)’:
../pcap_binding.cc:372: error: ‘pcap_lib_version’ was not declared in this scope
../pcap_binding.cc: At global scope:
../pcap_binding.cc:22: error: storage size of ‘fp’ isn’t known
Waf: Leaving directory `/usr/local/lib/node/.npm/pcap/0.2.1/package/build'
Build failed:  -> task failed (err #1): 
    {task: cxx pcap_binding.cc -> pcap_binding_1.o}
npm info [email protected] Failed to exec install script
npm ERR! install failed Error: [email protected] install: `node-waf configure build`
npm ERR! install failed `sh` failed with 1
npm ERR! install failed     at ChildProcess. (/usr/local/Cellar/npm/0.2.0/libexec/lib/utils/exec.js:24:18)
npm ERR! install failed     at ChildProcess.emit (events:33:26)
npm ERR! install failed     at ChildProcess.onexit (child_process:151:12)
npm ERR! install failed     at node.js:769:9
npm info install failed rollback
npm info not installed pcap,0.2.1
npm info install failed rolled back
npm ERR! Error: [email protected] install: `node-waf configure build`
npm ERR! `sh` failed with 1
npm ERR!     at ChildProcess. (/usr/local/Cellar/npm/0.2.0/libexec/lib/utils/exec.js:24:18)
npm ERR!     at ChildProcess.emit (events:33:26)
npm ERR!     at ChildProcess.onexit (child_process:151:12)
npm ERR!     at node.js:769:9
npm ERR! try running: 'npm help install'
npm ERR! Report this *entire* log at 
npm ERR! or email it to 
npm not ok

Looks like it expects to find pcap/pcap.h, but I only have /usr/include/pcap.h.

Any ideas?

Servus,

I just tried a very simple example (see code above) but do not got it running. Where is my error?
I run it on ubuntu 10.10 nodejs 0.4.10

Thanks in advance
Wolfgang

egger>node run.js

node.js:134
        throw e; // process.nextTick error, or 'error' event on first tick
        ^
TypeError: pcap Open: expecting 3 arguments
    at Pcap.open (/home/egger/xul-develop/workspace/node_pcap/pcap.js:44:34)
    at Object.createSession (/home/egger/xul-develop/workspace/node_pcap/pcap.js:90:13)
    at Object.<anonymous> (/home/egger/xul-develop/workspace/testjs/js/run.js:3:25)
    at Module._compile (module.js:402:26)
    at Object..js (module.js:408:10)
    at Module.load (module.js:334:31)
    at Function._load (module.js:293:12)
    at Array.<anonymous> (module.js:421:10)
    at EventEmitter._tickCallback (node.js:126:26)

run.js

var pcap = require('pcap'),
    tcp_tracker = new pcap.TCP_tracker(),
    pcap_session = pcap.createSession('eth0', '', 1024);

tcp_tracker.on('http_request', function (session, http) {
    console.log("Start of TCP session between " + session.src_name + " and " + session.dst_name);
});

Is there a possiblity to read pcap file instead of performing live sniffing?
Would be really great to analyse traffic dumps.

The algorithm for TCP retransmissions isn't quite right.

I am performing some performance measurements on node pcap and ecountered a critical bug. I am not entirely sure what the payload is that produces the bug, but any malformed (ip6?) header that cannot be parsed by decode.ip6_header should theoretically produce this bug.

Calling decode.packet on a malformed ip6 packet will result in decode.ip6_header beeing called recursivly. As soon as raw_packet[offset] produces undefined (which it will eventually) all hell breaks loose and the recursion will continue until a stack overflow occurs.
decode.ip6_header should check if offset is a valid value and return if it isn't.

This one is a loot of work. To start with there is support for watching files based on their names in Node.js under fs.watch. I suggest we add fs.FWatch to watch file descriptors.
Any ideas?

Hi,

Im running wlan0 into monitor mode and tried to inspect all packets in mon0. I get lots of packets, but, i get too many errors like this:

[Error: Unknown LLC types: DSAP: 221, SSAP: 153]

What this can be?

var pcap = require('pcap');
var pcap_session = pcap.createSession("mon0", "");

pcap_session.on('packet', function (raw_packet) {
    try {
        var packet = pcap.decode.packet(raw_packet);
        console.log(packet);
    } catch(err)  {
        console.log(err);
    }
});

Running Node v0.2.4 Stable, installing node_pcap from Git:

bourne@bourne-desktop:/usr/local/node$ node test.js
Version: v0.2.4
bourne@bourne-desktop:/usr/local/node$ cd node_pcap
bourne@bourne-desktop:/usr/local/node/node_pcap$ node-waf configure build
Checking for program g++ or c++          : /usr/bin/g++ 
Checking for program cpp                 : /usr/bin/cpp 
Checking for program ar                  : /usr/bin/ar 
Checking for program ranlib              : /usr/bin/ranlib 
Checking for g++                         : ok  
Checking for node path                   : not found 
Checking for node prefix                 : ok /usr/local 
'configure' finished successfully (0.027s)
Waf: Entering directory `/usr/local/node/node_pcap/build'
[1/2] cxx: pcap_binding.cc -> build/default/pcap_binding_1.o
../pcap_binding.cc: In function ‘v8::Handle Dispatch(const v8::Arguments&)’:
../pcap_binding.cc:89: error: ‘Data’ is not a member of ‘node::Buffer’
../pcap_binding.cc:90: error: ‘Length’ is not a member of ‘node::Buffer’
Waf: Leaving directory `/usr/local/node/node_pcap/build'
Build failed:  -> task failed (err #1): 
    {task: cxx pcap_binding.cc -> pcap_binding_1.o}
bourne@bourne-desktop:/usr/local/node/node_pcap$ whereis node
node: /usr/local/bin/node /usr/local/lib/node /usr/local/node
bourne@bourne-desktop:/usr/local/node/node_pcap$ 

Not sure why it is not finding the node path, but is that the reason why it is breaking?
Thanks

It'd be nice to know how many bytes the various http parsing functions consume, so that what's happening at that layer can be accurately mapped to what's actually in the packets.

This one is a loot of work. To start with there is support for watching files based on their names in Node.js under fs.watch. I suggest we add fs.fWatch to watch file descriptors.
Any ideas?

Has anyone gotten node_pcap to work in 0.10.3?

I can install, but when I try to use it, I get:

  module.js:356
    Module._extensions[extension](this, filename);
                               ^
  Error: Symbol pcap_binding_module not found.
    at Module.load (module.js:356:32)
    at Function.Module._load (module.js:312:12)
    at Module.require (module.js:364:17)
    at require (module.js:380:17)
    at Object.<anonymous>   (/usr/local/share/npm/lib/node_modules/htracr/node_modules/pcap/pcap.js:7:18)
    at Module._compile (module.js:456:26)
    at Object.Module._extensions..js (module.js:474:10)
    at Module.load (module.js:356:32)
    at Function.Module._load (module.js:312:12)
    at Module.require (module.js:364:17)

On OSX 10.8.3.

I try to build node_pcap on Debian-lenny 5.0 with nodejs(v0.2.5). I got the following error message after ran npm install pcap.

npm info it worked if it ends with ok
npm info using [email protected]
npm info using [email protected]
npm info preinstall [email protected]
npm info install [email protected]
Checking for program g++ or c++ : /usr/bin/g++
Checking for program cpp : /usr/bin/cpp
Checking for program ar : /usr/bin/ar
Checking for program ranlib : /usr/bin/ranlib
Checking for g++ : ok
Checking for node path : not found
Checking for node prefix : ok /usr/local
'configure' finished successfully (0.024s)
Waf: Entering directory /usr/local/lib/node/.npm/pcap/0.2.1/package/build' [1/2] cxx: pcap_binding.cc -> build/default/pcap_binding_1.o ../pcap_binding.cc: In function ‘v8::Handle<v8::Value> Open(bool, const v8::Arguments&)’: ../pcap_binding.cc:126: error: ‘pcap_create’ was not declared in this scope ../pcap_binding.cc:132: error: ‘pcap_set_snaplen’ was not declared in this scope ../pcap_binding.cc:137: error: ‘pcap_set_promisc’ was not declared in this scope ../pcap_binding.cc:142: error: ‘pcap_set_buffer_size’ was not declared in this scope ../pcap_binding.cc:147: error: ‘pcap_set_timeout’ was not declared in this scope ../pcap_binding.cc:157: error: ‘pcap_activate’ was not declared in this scope Waf: Leaving directory/usr/local/lib/node/.npm/pcap/0.2.1/package/build'
Build failed: -> task failed (err #1):
{task: cxx pcap_binding.cc -> pcap_binding_1.o}
npm info [email protected] Failed to exec install script
npm ERR! install failed Error: [email protected] install: node-waf configure build
npm ERR! install failed sh failed with 1
npm ERR! install failed at ChildProcess. (/usr/local/lib/node/.npm/npm/0.2.10/package/lib/utils/exec.js:24:18)
npm ERR! install failed at ChildProcess.emit (events:27:15)
npm ERR! install failed at ChildProcess.onexit (child_process:168:12)
npm ERR! install failed at node.js:773:9
npm info install failed rollback
npm info not installed pcap,0.2.1
npm info install failed rolled back
npm ERR! Error: [email protected] install: node-waf configure build
npm ERR! sh failed with 1
npm ERR! at ChildProcess. (/usr/local/lib/node/.npm/npm/0.2.10/package/lib/utils/exec.js:24:18)
npm ERR! at ChildProcess.emit (events:27:15)
npm ERR! at ChildProcess.onexit (child_process:168:12)
npm ERR! at node.js:773:9
npm ERR!
npm ERR! Failed at the [email protected] install script.
npm ERR! This is most likely a problem with the pcap package,
npm ERR! not with npm itself.
npm ERR! Tell the author that this fails on your system:
npm ERR! node-waf configure build
npm ERR! You can get their info via:
npm ERR! npm owner ls pcap
npm ERR! There may be additional logging output above.
npm not ok

Any idea?

On the readme, all the TCP_tracker events have underscores, e.g. http_request. When listening to these underscored events I never get a callback.

After playing around with it, the actual events have spaces instead (http request), as listening to these events seems to work correctly.

I may just be really tired, and so I'll apologise for the noise in advance.

I'm looking to make sure htracr works on node 0.3.7, but when I try to listen I get:

> sess = pcap.createSession('eth0', 'tcp port 80', 10*1024*1024)
TypeError: pcap Open: expecting 3 arguments
    at Pcap.open (/Users/mnotting/.node_libraries/.npm/pcap/0.2.7/package/pcap.js:44:34)
    at Object.createSession (/Users/mnotting/.node_libraries/.npm/pcap/0.2.7/package/pcap.js:90:13)

However, looking at your source (both on Github and on my filesystem), it looks like binding.open_live is being called with three:

this.link_type = binding.open_live(this.device_name, filter || "", this.buffer_size);

Nothing interesting to report about the pcap installation, except that I have to install with CXXFLAGS="-I/opt/local/include -L/opt/local/lib" (for MacPorts).

Same works just fine on node 0.2.x.

> pcap.lib_version
'libpcap version 1.1.1'

Does this seem familiar?

Below is the error I get, the file path I try to open is legitimate and I even tried running node as root just to verify it wasn't a permissions error. The error code returning from libpcap is junk text. Any idea how to debug this?

I've also verified, node, pcap_bindings, and libpcap are compiled for 64bit.

node.js code:
pcap_session = pcap.createOfflineSession(this.fileName, "ip proto \tcp");

Error: ӹ!pz3
at Pcap.open (/home/user/pcap/node_modules/pcap/pcap.js:54:34)

Strace output
open("/home/user/pcap/split01.pcap", O_RDONLY) = 12
fstat(12, {st_mode=S_IFREG|0644, st_size=160502, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f5f38545000
read(12, "\324\303\262\241\2\0\4\0\0\0\0\0\0\0\0\0\377\377\0\0\1\0\0\0\t\260\376PtZ\r\0"..., 4096) = 4096
futex(0x7f5f300008c8, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0x7f5f300008c8, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0x7f5f300008c8, FUTEX_WAKE_PRIVATE, 1) = 1
gettimeofday({1362448162, 937154}, NULL) = 0
gettimeofday({1362448162, 937808}, NULL) = 0
futex(0x7f5f300008c8, FUTEX_WAKE_PRIVATE, 1) = 1
ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, {B9600 opost isig icanon echo ...}) = 0
ioctl(2, TIOCGWINSZ, {ws_row=36, ws_col=153, ws_xpixel=1071, ws_ypixel=504}) = 0
futex(0x7f5f300008c8, FUTEX_WAKE_PRIVATE, 1) = 1
write(2, "Error: \323\225R\30\357\277\2754\n at Pcap.open"..., 840Error: ӕR�4
at Pcap.open (/home/user/pcap/node_modules/pcap/pcap.js:54:34)

Please use node-gyp as node-waf does not exist on windows.

Was wondering if IPv6 is supported. The README says it does not, but the code and the changelog says it does to some extent.

Thanks,
bocajspear1