Skip to content
A tool that provides a basic SQL-frontend to PCAP-files
JavaScript C++ CSS HTML Shell Perl Other
Branch: develop
Clone or download
Latest commit e13ebf3 Sep 3, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
.copr COPR, spec Sep 3, 2019
.github Funding Jun 25, 2019
collector_sample Added pcap. to filename May 4, 2011
debian Release 1.4.1 Nov 9, 2017
html moved files up May 2, 2011
html_NG Added our extended GUI Jan 21, 2013
pcap - fixed reading of big-endian pcap files (including gzipped pcap) May 23, 2017
rpm COPR, spec Sep 3, 2019
src Fix #61: Make sure variables are initialized Nov 9, 2017
.clang-format Update code format and move Murmur into it's own dir Aug 17, 2017
.gitignore Cleanup and license change May 15, 2017
.travis.yml Travis-CI Dec 21, 2018
COPYING Cleanup and license change May 15, 2017 Move wiki documentation into the repository May 19, 2017 Update documentation and tests Jun 8, 2017 Move wiki documentation into the repository May 19, 2017 Add regression test (from example) for all output formats May 22, 2017 Release 1.3.0 May 23, 2017 Cleanup and license change May 15, 2017 Release 1.4.1 Nov 9, 2017


Build Status Coverity Scan Build Status

packetq is a command line tool to run SQL queries directly on PCAP files, the results can be outputted as JSON (default), formatted/compact CSV and XML. It also contain a very simplistic web-server in order to inspect PCAP files remotely. PacketQ was previously known as DNS2db but was renamed in 2011 when it was rebuilt and could handle protocols other than DNS among other things.

More information is provided in our FAQ, functions, and fields documentation.

A short demo-video of PacketQ's capabilities is available on


  • Super-fast native decoding of PCAP-files (even gzipped) and dirt-quick in-memory sorting algorithms.
  • A extensible protocol decoding design with build in support for ICMP and DNS from start.
  • Support for grouping, sorting, counting and most other important SQL-functions.
  • Only dependent on zlib, no other hard-to-find libs needed. Compiles on everything.
  • Build-in web-server, JSON API and a simple JQuery-based GUI concept application with graphs.
  • Can be designed to cache queries by pre-processing PCAPs into static JSON-files that can be used to make queries again.
  • Built in DNS-resolver function (used by GUI).
  • Support for sampling. Helps when making queries to large, uniform PCAP-files.
  • Can convert flags in packet-headers to text on the fly.
  • Can make multiple queries towards the same data in memory.


PacketQ requires a couple of libraries beside a normal C++ compiling environment with Autoconf and Automake.

To install the dependencies under Debian/Ubuntu:

apt-get install -y zlib1g-dev

To install the dependencies under CentOS (with EPEL enabled):

yum install -y zlib-devel

Build from GitHub

git clone
cd PacketQ
make install

Build from tarball

cd packetq-VERSION...
make install

Usage example

Retrieves the 10 first packets containing DNS information from the file sample.pcap:

packetq -s "select * from dns limit 10" sample.pcap

Starts a web-server on port 8080 (-p8080) as a daemon (-d) serving files from the directory html/ (-w html/) and PCAP files from the directory pcap/ (-r pcap/):

packetq -d -p8080 -w html/ -r pcap/



See also the full list of contributors.


Copyright (c) 2017, OARC, Inc.

Copyright (c) 2011-2017, IIS - The Internet Foundation in Sweden

All rights reserved.

This file is part of PacketQ.

PacketQ is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

PacketQ is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with PacketQ.  If not, see <>.
You can’t perform that action at this time.