io.github.daedalus/mcp-pcapy-ng

Get the data link type from a pcap handle. Args: pcap_info: Dictionary from open_live or open_offline. Returns: Integer DLT value (e.g., 1 for Ethernet). Example: >>> pcap_datalink({'device': 'eth0'}) 1

Lists all available network interfaces on the system. Returns: List of dictionaries, each containing interface details: - name: Interface name (e.g., 'eth0') - description: Interface description - addresses: List of address dictionaries - flags: Interface flags Example: >>> findalldevs() [{'name': 'eth0', 'description': 'Ethernet', 'addresses': [...], 'flags': [...]}]

Gets the default network device for packet capture. Returns: String containing the default device name (e.g., 'eth0'). Raises: RuntimeError: If no default device can be found. Example: >>> lookupdev() 'eth0'

Opens a live network interface for packet capture. Args: device: Network device name (e.g., 'eth0'). Use findalldevs() to list available. snaplen: Maximum number of bytes to capture per packet (default: 65535). promisc: Put interface in promiscuous mode (default: True). to_ms: Read timeout in milliseconds (default: 1000). Returns: Dictionary with pcap handle info including: - datalink: Data link type constant - device: Device name - snaplen: Snapshot length - nonblock: Whether in non-blocking mode Raises: PcapError: If the device cannot be opened. Example: >>> open_live('eth0') {'datalink': 1, 'device': 'eth0', 'snaplen': 65535, 'nonblock': False}

Creates a packet capture handle to look at packets on the network. This creates a handle that can be configured before being activated. Use this for more control over the capture setup. Args: device: Network device name. Returns: Dictionary with pcap handle info. Raises: PcapError: If the device cannot be created. Example: >>> create('eth0') {'device': 'eth0', 'created': True}

Opens a pcap file for reading packet captures. Args: filename: Path to the pcap file. Returns: Dictionary with pcap file info including: - datalink: Data link type constant - filename: File path - readable: Whether file is readable Raises: PcapError: If the file cannot be opened. Example: >>> open_offline('/tmp/capture.pcap') {'datalink': 1, 'filename': '/tmp/capture.pcap', 'readable': True}

Creates a BPF (Berkeley Packet Filter) program for packet filtering. Args: linktype: DLT link type (e.g., DLT_EN10MB=1 for Ethernet). snaplen: Snapshot length. filter_str: BPF filter expression (e.g., 'tcp and port 80'). optimize: Optimize the filter (default: True). netmask: Netmask for the filter (default: 0xFFFFFFFF). Returns: Dictionary with compiled filter info: - compiled: Whether successful - filter: Filter expression - linktype: DLT used Raises: BPFError: If the filter expression is invalid. Example: >>> compile(1, 65535, 'tcp and port 80') {'compiled': True, 'filter': 'tcp and port 80', 'linktype': 1}

Read packets from a pcap handle. Args: pcap_info: Dictionary from open_live or open_offline (contains device/filename). count: Maximum number of packets to read (default: 1). Returns: List of tuples: (timestamp_unix_float, raw_packet_bytes). Example: >>> pcap_read({'device': 'eth0', 'datalink': 1}, count=10) [(1234567890.123, b'\x00\x01...'), ...]

Attach a compiled BPF filter to a pcap handle. Args: pcap_info: Dictionary from open_live or open_offline. filter_info: Dictionary from compile(). Returns: True if filter was set successfully. Raises: PcapError: If filter cannot be set. Example: >>> pcap_setfilter({'device': 'eth0'}, {'filter': 'tcp', 'linktype': 1}) True

Get the non-blocking status of a pcap handle. Args: pcap_info: Dictionary from open_live or open_offline. Returns: True if in non-blocking mode, False otherwise. Example: >>> pcap_getnonblock({'device': 'eth0'}) False

Set the non-blocking mode of a pcap handle. Args: pcap_info: Dictionary from open_live or open_offline. nonblock: True for non-blocking mode, False for blocking. Returns: True if mode was set successfully. Example: >>> pcap_setnonblock({'device': 'eth0'}, True) True

Get mapping of DLT (Data Link Type) constants to their names. Returns: Dictionary mapping DLT names to constant values. Example: >>> get_dlt_names() {'DLT_NULL': 0, 'DLT_EN10MB': 1, 'DLT_IEEE802_11': 105, ...}

Get mapping of PCAP direction constants to their names. Returns: Dictionary mapping direction names to constant values. Example: >>> get_pcap_directions() {'PCAP_D_INOUT': 0, 'PCAP_D_IN': 1, 'PCAP_D_OUT': 2}

Get all pcapy constants (DLT types, directions, errors). Returns: Dictionary with all constants. Example: >>> get_constants() {'DLT_EN10MB': 1, 'PCAP_D_IN': 1, ...}