API

• createInterfaceSniffer
• createFileSniffer
• Sniffer

createInterfaceSniffer(dev, [opts])

• dev {String} Device to listen on.
• opts {Object} Capture options (refer to PCAP's documentation for more information):
  • snaplen {Number} Maximum capture PDU length.
  • promisc {Boolean}
  • rfmon {Boolean}
  • timeout {Number} Defaults to 1000.
  • bufferSize {Number}
  • filter {String}
  • batchSize {Number}

Returns a live network Sniffer.

createFileSniffer(path, [opts])

• dev {String} Path to capture file.
• opts {Object} Capture options:
  • batchSize {Number}

Returns a Sniffer emitting PDUs stored in a capture file.

class Sniffer

Event 'pdu'

• pdu {Object} Decoded PDU.

Emitted each time a PDU is decoded.

Event 'batch'

• n {Number} Number of PDUs captured in this batch.

Emitted each time a new batch of PDUs arrives (before they are decoded).

Event 'end'

Emitted when there are no more PDUs available (either because it is the end of a capture file or because the sniffer was destroyed).

sniffer.destroy()

Disable the sniffer.

sniffer.stream()

Convenience method to expose a stream-like interface, returning a readable stream of PDUs.

This isn't the default because the main reason behind streams (backpressure) doesn't apply for live captures (PDUs will be dropped), so the extra complexity and performance hit aren't worth it in general.

Warning: any non-consumed PDUs will be buffered in memory! (So beware when using this method on high-throughput sniffers.)