You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The `pcap` extension has been developed against PHP 7.4+ and regularly tested against the upcoming PHP 8.
10
10
11
-
The extension provides bindings for [libpcap](https://github.com/the-tcpdump-group/libpcap) and exposes its functionality via PHP streams; the packet formatting is consistent with the `pcap` file format (learn more [here](https://wiki.wireshark.org/Development/LibpcapFileFormat) and [here](https://formats.kaitai.io/pcap/index.html)).
11
+
The extension provides bindings for [libpcap](https://github.com/the-tcpdump-group/libpcap) and exposes its functionality via PHP streams; the packet formatting is consistent with the `pcap` file format (learn more [here](https://wiki.wireshark.org/Development/LibpcapFileFormat) and [here](https://formats.kaitai.io/pcap/index.html)). The functionality is deliberately limited to I/O operations, the actual packet parsing/crafting should be performed using pure PHP; such supporting libraries will be open sourced soon.
12
12
13
13
It's also worth familiarizing yourself with [libpcap and tcpdump](https://www.tcpdump.org/index.html).
14
14
15
+
A typical capture session can be initiated as follows:
16
+
17
+
```php
18
+
$fp = fopen('pcap://eth0', 'r');
19
+
```
20
+
21
+
The above will initiate the capture session on the `eth0` interface; one can retrieve all network interfaces via `net_get_interfaces()`. An `any` meta-interface is also available.
22
+
23
+
There are several configuration options exposed through stream contexts:
'filter' => 'dst port 53', // Reference: https://www.tcpdump.org/manpages/pcap-filter.7.html
34
+
],
35
+
]);
36
+
37
+
$fp = fopen('pcap://any', 'r', false, $context);
38
+
```
39
+
40
+
All I/O operations are no different than any other PHP stream, for example:
41
+
42
+
```php
43
+
$fp = fopen('pcap://eth0', 'r');
44
+
45
+
$header = unpack('LtsSec/LtsUsec/LcapLen/Llen', fread($fp, 16)); // pcap packet header, using local machine endianness
46
+
$frame = fread($fp, $header['capLen']);
47
+
48
+
var_dump($header)
49
+
/*
50
+
array(4) {
51
+
["tsSec"]=>
52
+
int(1598997114)
53
+
["tsUsec"]=>
54
+
int(239648)
55
+
["capLen"]=>
56
+
int(96)
57
+
["len"]=>
58
+
int(96)
59
+
}
60
+
*/
61
+
62
+
// process($frame) ...
63
+
```
64
+
65
+
The [tests](https://github.com/rtckit/php-pcap-ext/tree/master/tests) directory show cases some usage examples.
66
+
15
67
## Build
16
68
17
69
In order to build the extension from source, make sure the environment supports the typical C/C++ build essentials for your platform (`build-essential`), the PHP development files (`php-dev`) as well as the libpcap library and its respective development files (`libpcap-dev`).
0 commit comments