Registry / serialization / pcap-parser

pcap-parser

JSON →
library0.2.1jsnpmunverified

pcap-parser is a Node.js module designed to parse `.pcap` packet capture files. Originally published in 2012, its current and last stable version is 0.2.1. This library focuses on the raw parsing of pcap file headers and individual packet data, emitting events for global header, packet header, packet data, and complete packets. It strictly supports only version 2.4 of the `libpcap` file format in both big-endian and little-endian formats. Due to its age, it primarily caters to older Node.js environments (engine requirement `>=0.6.0`) and does not support the newer `pcapng` format or provide high-level protocol decoding. Its release cadence is non-existent, as it has not been updated in over a decade. While functional for its specific, limited purpose, developers should be aware of its lack of maintenance and consider modern alternatives for broader compatibility or advanced features.

serializationhttp-networking
npm install pcap-parser
github ↗package ↗
INSTALL
IMPORT
SIG · PCAP-PARSER
P
pcap-parser
serializationjavascriptv0.2.1
Install
—
Import
—
Disk
—
Pass rate
0/ 6
Env Coverage0 / 6
glibc
18–22
musl
18–22
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
node 18–226 runs
build_error
glibc
node 18–226 runs
build_error
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

Parser
✓ const pcapp = require('pcap-parser'); const parser = new pcapp.Parser('/path/to/file.pcap');
✗ import { Parser } from 'pcap-parser';
This package is CommonJS-only, designed for older Node.js versions. ESM import syntax is not supported and will fail.
Parser (Stream)
✓ const pcapp = require('pcap-parser'); const fs = require('fs'); const readableStream = fs.createReadStream('/path/to/file.pcap'); const parser = new pcapp.Parser(readableStream);
The Parser constructor also accepts a readable stream, allowing for parsing directly from stream sources.
Event: 'packet'
✓ const pcapp = require('pcap-parser'); const parser = new pcapp.Parser('/path/to/file.pcap'); parser.on('packet', function(packet) { // packet.header and packet.data (Buffer) });
✗ parser.addListener('packet', (packet) => { /* ... */ });
The library extends EventEmitter, so `on` is the idiomatic method for event subscription. While `addListener` works, `on` is more commonly used.

This quickstart demonstrates how to instantiate the PCAP parser with a file path, listen for `globalHeader`, `packet`, and `end` events, and then initiate the parsing process. It includes a small self-contained dummy pcap file creation for immediate execution.

const pcapp = require('pcap-parser'); const path = require('path'); const fs = require('fs'); // Create a dummy pcap file for demonstration if it doesn't exist const dummyPcapPath = path.join(__dirname, 'dummy.pcap'); if (!fs.existsSync(dummyPcapPath)) { // This is a minimal valid pcap global header followed by an empty packet header // Magic number (0xa1b2c3d4), major=2, minor=4, GMT=0, accuracy=0, snaplen=65535, linktype=1 (Ethernet) const dummyPcapData = Buffer.from([ 0xd4, 0xc3, 0xb2, 0xa1, // magic_number (little-endian) 0x02, 0x00, 0x04, 0x00, // version_major, version_minor 0x00, 0x00, 0x00, 0x00, // thiszone 0x00, 0x00, 0x00, 0x00, // sigfigs 0xff, 0xff, 0x00, 0x00, // snaplen (65535) 0x01, 0x00, 0x00, 0x00, // network (LINKTYPE_ETHERNET) // Empty packet data 0x00, 0x00, 0x00, 0x00, // ts_sec 0x00, 0x00, 0x00, 0x00, // ts_usec 0x00, 0x00, 0x00, 0x00, // incl_len 0x00, 0x00, 0x00, 0x00 // orig_len ]); fs.writeFileSync(dummyPcapPath, dummyPcapData); console.log(`Created dummy pcap file at ${dummyPcapPath}`); } const parser = new pcapp.Parser(dummyPcapPath); let packetCount = 0; parser.on('globalHeader', function(header) { console.log('Global Header:', header); }); parser.on('packet', function(packet) { packetCount++; console.log(`Packet ${packetCount}:`, { header: packet.header, dataLength: packet.data.length }); // You can process packet.data (a Buffer) here }); parser.on('end', function() { console.log(`Finished parsing. Total packets: ${packetCount}`); // Clean up dummy file fs.unlinkSync(dummyPcapPath); console.log(`Removed dummy pcap file: ${dummyPcapPath}`); }); parser.on('error', function(err) { console.error('Parser error:', err); }); parser.parse(); // Initiate parsing
Debug
Known issues
breakingThis package is effectively abandoned, with its last update in April 2012. It is unlikely to be compatible with recent Node.js versions (e.g., Node.js 16+) without significant runtime issues or requiring legacy Node.js environments. Node.js `Buffer` API changes and internal stream implementations may cause unexpected behavior.
fix
Consider using modern alternatives like `@cto.af/pcap-ng-parser` or `pcap-ng-parser` for `pcapng` files and broader compatibility, or `node-pcap` for live capture and potentially better maintenance, though also quite old. If possible, use external tools (e.g., `tshark`) for parsing and pipe output.
affects: >=0.2.1
gotchaThe library only parses `libpcap` file format version 2.4. It does NOT support the newer and more common `pcapng` format (`.pcapng` files). Attempting to parse `pcapng` files will likely result in parsing errors or incomplete/incorrect data.
fix
Ensure your `.pcap` files are in the legacy `libpcap` format (version 2.4). If you have `.pcapng` files, convert them to `.pcap` using tools like Wireshark/tshark, or use a `pcapng`-specific parser library.
affects: >=0.2.1
gotchaThe package uses CommonJS `require()` syntax exclusively. It does not provide ESM exports, meaning direct `import pcapp from 'pcap-parser'` statements will fail in pure ESM Node.js environments.
fix
If used in an ESM module, wrap the import in a dynamic `import()` statement or configure your project to allow CommonJS interoperability (e.g., by using an older Node.js version or a bundler that handles CJS-in-ESM).
affects: >=0.2.1
gotchaError handling is primarily via the 'error' event. If an 'error' event listener is not registered, any unhandled errors from the underlying stream or parsing process will crash the Node.js application.
fix
Always register an `error` event listener on the `Parser` instance to gracefully handle file I/O errors, corruption, or other parsing issues: `parser.on('error', (err) => console.error('Parsing error:', err));`
affects: >=0.2.1
Errors
Common errors & fixes
TypeError: pcapp.Parser is not a constructor
Attempting to use `new pcapp.parser()` or `pcapp.default()` instead of `new pcapp.Parser()`.
fix
Ensure you are using `new pcapp.Parser()` with a capital 'P' for the constructor.
Error: ENOENT: no such file or directory, open '/path/to/nonexistent.pcap'
The specified PCAP file path does not exist or is inaccessible.
fix
Verify that the file path provided to the `pcapp.Parser` constructor is correct and that the Node.js process has read permissions for the file.
Error: Cannot find module 'pcap-parser'
The `pcap-parser` package has not been installed or is not resolvable from the current working directory or `NODE_PATH`.
fix
Run `npm install pcap-parser` in your project directory to ensure the package is installed and available.
Upgrade
Version history
0.2.1latest on npm
Audit
Dependencies

No dependency data recorded yet.

Agent activity
2 hits · last 30 days
node
2
Resources
githubhttps://github.com/nearinfinity/node-pcap-parser ↗
packagehttps://www.npmjs.com/package/pcap-parser ↗
pcap-parser — npm install pcap-parser · libregistry