1. Summary
  2. Files
  3. Support
  4. Report Spam
  5. Create account
  6. Log in

Main Page

From sharppcap

Jump to: navigation, search



Welcome to the SharpPcap main page.

SharpPcap is a cross platform .Net assembly for interfacing with libpcap/winpcap.

SharpPcap handles the network portion of things, Packet.Net handles the packet dissection and construction.

Download SharpPcap

To download SharpPcap visit the SharpPcap project page

If we could put the download now button here we would but we aren't sure how to yet.

API documentation

Preliminary API documentation generated from the c# inline xml can be found at API docs

SharpPcap vs. Packet.Net

SharpPcap and Packet.Net are related. Packet parsing was originally a part of SharpPcap but was split out into Packet.Net in SharpPcap 3.0. Here is a helpful comparison created by Evan Plaice:


  • is a libpcap/winpcap wrapper
  • implements filtering in a hardware interface level
  • captures packets from a network
  • captures data in its raw format
  • (capturing) the entry point is from the selected network interface
  • (capturing) the exit point is passing a byte[] and/or statistics info on a capture
  • (transmission) the entry point is receiving a byte[] for transmission
  • (transmission) the exit point is, the data is sent across the NIC


  • is a networking packet parser
  • is capable of retrieving the header/payload of any layer in the networking stack (at least below the application layer)
  • transforms a raw byte[] of data into a usable structure through calculated carefully calculated offsets and lazy-loading (for efficiency)
  • supports the ability to create a networking packet structure (using the same lazy-loading as parsing) that can be transformed into a raw byte[] for transmission
  • (parsing) the entry point is a byte[] being passed in for processing
  • (parsing) the exit point is the detailed data being outputted to the user
  • (packet creation) the entry point is a networking packet structure
  • (packet creation) the exit point is a raw byte[] being passed along to be transmitted

SharpPcap v4.1 released

Integrates Packet.Net 0.12.0. This release contains a ton of work by Alan Rushforth and others that brings 802.11 packet parsing and generation support to Packet.Net.

SharpPcap v4.0 released

This version brings huge performance gains, >50% for raw packet capture rates, due to profiling and ideas from Michael Giagnocavo. There have also been some api changes:

  • OfflinePcapDevice / OfflineCaptureDevice have been replaced by CaptureFileReaderDevice and CaptureFileWriterDevice.
  • Dump methods have been removed from other capture devices. Please use the two new reader/writer classes instead.

This change makes it easy to create a dump file from scratch, something that wasn't possible with the previous release of the library.

SharpPcap v3.5.0 released

v3.5.0 brings several new features including AirPcap support and WinPcap remote capture. These changes required a bit of restructuring internally.

At the highest level all capture devices are of type ICaptureDevice. To retrieve a list of devices you should use SharpPcap.CaptureDeviceList.

CaptureDeviceList returns an array of specific instances of devices but these are type ICaptureDevice so these devices can be delt with generically.

There are three types of devices:

  • LibPcapDevice
    • WinPcapDevice
      • AirPcapDevice

These devices are nested. An AirPcapDevice is a WinPcapDevice which is a LibPcapDevice.

On Linux, which lacks AirPcap or WinPcap support, all devices will be LibPcapDevices. On Windows all devices should be WinPcap or AirPcapDevices.

If you want to retrieve a list of specific types of devices you should use the device specific List class. For LibPcapDevices -> LibPcapLiveDeviceList, for WinPcapDevices -> WinPcapDeviceList, AirPcapDevice -> AirPcapDeviceList. Note that a list of WinPcapDevices will include AirPcapDevices as all AirPcapDevices appear as WinPcapDevices.

SharpPcap v3.0.0 has been released!

From the v3.0.0 release notes:

SharpPcap v3.0.0 signifies major api changes from the 2.x series of releases. All of SharpPcap's packet parsing classes have been removed. The packet parsing functionality has been replaced with Packet.Net v0.3.0 (http://packetnet.sf.net).

The two reasons for splitting the packet parsing functionality into a separate library were to remove functionality unrelated to pcap from SharpPcap for the purpose of modularity and to revisit the design of the packet parsing code. During the split the packet parsing code was rewritten to simplify the creation of packets from values and cleanup many of the packet class properties.


  • Cross platform. A single assembly works on Windows 32/64 bit, Linux 32/64 bit, and Mac platforms.
  • Fully managed code (except for calls to libpcap/winpcap low-level libraries) written in well documented C#
  • Microsoft .Net and Mono are fully supported
  • High performance - Can capture network traffic in excess of 3MB/sec with minimal packet loss
  • Full support for all libpcap/winpcap features including almost all winpcap extension features
  • WinPcap Remote Capture
  • AirPcap capture support
  • Packet dissectors and constructors for:
  • Filters

Getting started


Check out the CodeProject SharpPcap tutorial that has been recently updated on 2010-01-27 for the SharpPcap v2.4.0 API.


The SharpPcap source package also contains several examples to help you get started using SharpPcap. Download the source package here.

You can also browse the examples via the SharpPcap Git web interface


  • Listing available interfaces and information about these interfaces (Example 1)
  • Capturing packets via a callback (Example 3)
  • Synchronous packet capturing (Example 4)
  • Reading from a pcap formatted capture file like those generated by tcpdump or wireshark
  • Setting capture filters (Example 5)
  • Background packet processing (QueuingPacketsForBackgroundProcessing)
  • Sending packets (Example 9)
  • Modifying packets (Example 12)
  • Winpcap statistics mode (Example 11)

Best practices

  • Do's
    • Process packets as quickly as possible in the capture device callback
    • Measure packet loss with PcapDevice.Statistics() by calling it periodically on your capture devices
    • For UI interaction use a queuing solution like the 'QueuingPacketsForBackgroundProcessing' example in the source code package to perform UI updates from a background thread.

  • Don'ts
    • No gui updates from the capture device callback or between the blocking GetPacket() calls. This includes using BeginInvoke() to update your UI. The delay is likely to cause packet loss. This is good advice for any kind of performance related code. Always update the UI from a different thread/process than you are performing time-critical work in.

Other helpful resources: WinPcap Do's and Don'ts from Sharkfest 2009


Sharkfest presentations

Problems, feature missing?

Please visit our support page and submit a bug or feature request so we know what to fix or add to SharpPcap.

Personal tools