{"id":13755,"library":"pcap-parser","title":"PCAP File Parser for Node.js","description":"pcap-parser is a Node.js module designed to parse `.pcap` packet capture files. Originally published in 2012, its current and last stable version is 0.2.1. This library focuses on the raw parsing of pcap file headers and individual packet data, emitting events for global header, packet header, packet data, and complete packets. It strictly supports only version 2.4 of the `libpcap` file format in both big-endian and little-endian formats. Due to its age, it primarily caters to older Node.js environments (engine requirement `>=0.6.0`) and does not support the newer `pcapng` format or provide high-level protocol decoding. Its release cadence is non-existent, as it has not been updated in over a decade. While functional for its specific, limited purpose, developers should be aware of its lack of maintenance and consider modern alternatives for broader compatibility or advanced features.","status":"abandoned","version":"0.2.1","language":"javascript","source_language":"en","source_url":"git://github.com/nearinfinity/node-pcap-parser","tags":["javascript","pcap","parser"],"install":[{"cmd":"npm install pcap-parser","lang":"bash","label":"npm"},{"cmd":"yarn add pcap-parser","lang":"bash","label":"yarn"},{"cmd":"pnpm add pcap-parser","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"This package is CommonJS-only, designed for older Node.js versions. ESM import syntax is not supported and will fail.","wrong":"import { Parser } from 'pcap-parser';","symbol":"Parser","correct":"const pcapp = require('pcap-parser');\nconst parser = new pcapp.Parser('/path/to/file.pcap');"},{"note":"The Parser constructor also accepts a readable stream, allowing for parsing directly from stream sources.","symbol":"Parser (Stream)","correct":"const pcapp = require('pcap-parser');\nconst fs = require('fs');\nconst readableStream = fs.createReadStream('/path/to/file.pcap');\nconst parser = new pcapp.Parser(readableStream);"},{"note":"The library extends EventEmitter, so `on` is the idiomatic method for event subscription. While `addListener` works, `on` is more commonly used.","wrong":"parser.addListener('packet', (packet) => { /* ... */ });","symbol":"Event: 'packet'","correct":"const pcapp = require('pcap-parser');\nconst parser = new pcapp.Parser('/path/to/file.pcap');\nparser.on('packet', function(packet) {\n  // packet.header and packet.data (Buffer)\n});"}],"quickstart":{"code":"const pcapp = require('pcap-parser');\nconst path = require('path');\nconst fs = require('fs');\n\n// Create a dummy pcap file for demonstration if it doesn't exist\nconst dummyPcapPath = path.join(__dirname, 'dummy.pcap');\nif (!fs.existsSync(dummyPcapPath)) {\n  // This is a minimal valid pcap global header followed by an empty packet header\n  // Magic number (0xa1b2c3d4), major=2, minor=4, GMT=0, accuracy=0, snaplen=65535, linktype=1 (Ethernet)\n  const dummyPcapData = Buffer.from([\n    0xd4, 0xc3, 0xb2, 0xa1, // magic_number (little-endian)\n    0x02, 0x00, 0x04, 0x00, // version_major, version_minor\n    0x00, 0x00, 0x00, 0x00, // thiszone\n    0x00, 0x00, 0x00, 0x00, // sigfigs\n    0xff, 0xff, 0x00, 0x00, // snaplen (65535)\n    0x01, 0x00, 0x00, 0x00, // network (LINKTYPE_ETHERNET)\n    // Empty packet data\n    0x00, 0x00, 0x00, 0x00, // ts_sec\n    0x00, 0x00, 0x00, 0x00, // ts_usec\n    0x00, 0x00, 0x00, 0x00, // incl_len\n    0x00, 0x00, 0x00, 0x00  // orig_len\n  ]);\n  fs.writeFileSync(dummyPcapPath, dummyPcapData);\n  console.log(`Created dummy pcap file at ${dummyPcapPath}`);\n}\n\nconst parser = new pcapp.Parser(dummyPcapPath);\nlet packetCount = 0;\n\nparser.on('globalHeader', function(header) {\n  console.log('Global Header:', header);\n});\n\nparser.on('packet', function(packet) {\n  packetCount++;\n  console.log(`Packet ${packetCount}:`, {\n    header: packet.header,\n    dataLength: packet.data.length\n  });\n  // You can process packet.data (a Buffer) here\n});\n\nparser.on('end', function() {\n  console.log(`Finished parsing. Total packets: ${packetCount}`);\n  // Clean up dummy file\n  fs.unlinkSync(dummyPcapPath);\n  console.log(`Removed dummy pcap file: ${dummyPcapPath}`);\n});\n\nparser.on('error', function(err) {\n  console.error('Parser error:', err);\n});\n\nparser.parse(); // Initiate parsing","lang":"javascript","description":"This quickstart demonstrates how to instantiate the PCAP parser with a file path, listen for `globalHeader`, `packet`, and `end` events, and then initiate the parsing process. It includes a small self-contained dummy pcap file creation for immediate execution."},"warnings":[{"fix":"Consider using modern alternatives like `@cto.af/pcap-ng-parser` or `pcap-ng-parser` for `pcapng` files and broader compatibility, or `node-pcap` for live capture and potentially better maintenance, though also quite old. If possible, use external tools (e.g., `tshark`) for parsing and pipe output.","message":"This package is effectively abandoned, with its last update in April 2012. It is unlikely to be compatible with recent Node.js versions (e.g., Node.js 16+) without significant runtime issues or requiring legacy Node.js environments. Node.js `Buffer` API changes and internal stream implementations may cause unexpected behavior.","severity":"breaking","affected_versions":">=0.2.1"},{"fix":"Ensure your `.pcap` files are in the legacy `libpcap` format (version 2.4). If you have `.pcapng` files, convert them to `.pcap` using tools like Wireshark/tshark, or use a `pcapng`-specific parser library.","message":"The library only parses `libpcap` file format version 2.4. It does NOT support the newer and more common `pcapng` format (`.pcapng` files). Attempting to parse `pcapng` files will likely result in parsing errors or incomplete/incorrect data.","severity":"gotcha","affected_versions":">=0.2.1"},{"fix":"If used in an ESM module, wrap the import in a dynamic `import()` statement or configure your project to allow CommonJS interoperability (e.g., by using an older Node.js version or a bundler that handles CJS-in-ESM).","message":"The package uses CommonJS `require()` syntax exclusively. It does not provide ESM exports, meaning direct `import pcapp from 'pcap-parser'` statements will fail in pure ESM Node.js environments.","severity":"gotcha","affected_versions":">=0.2.1"},{"fix":"Always register an `error` event listener on the `Parser` instance to gracefully handle file I/O errors, corruption, or other parsing issues: `parser.on('error', (err) => console.error('Parsing error:', err));`","message":"Error handling is primarily via the 'error' event. If an 'error' event listener is not registered, any unhandled errors from the underlying stream or parsing process will crash the Node.js application.","severity":"gotcha","affected_versions":">=0.2.1"}],"env_vars":null,"search_vec":"'0.2.1':31 '0.6.0':93 '2.4':64 '2012':23 'advanc':150 'age':83 'altern':145 'awar':136 'big':73 'big-endian':72 'broader':147 'cadenc':111 'captur':18 'cater':86 'compat':148 'complet':57 'consid':143 'current':25 'data':46,55 'decad':125 'decod':108 'design':13 'develop':133 'due':80 'emit':47 'endian':74,78 'engin':91 'environ':90 'event':48 'exist':115 'featur':151 'file':2,19,41,68 'focus':34 'format':69,79,101 'function':127 'global':50 'header':42,51,53 'high':105 'high-level':104 'individu':44 'javascript':152 'lack':139 'last':27 'level':106 'libpcap':67 'librari':33 'limit':131 'littl':77 'little-endian':76 'mainten':141 'modern':144 'modul':12 'newer':99 'node.js':5,11,89 'non':114 'non-exist':113 'older':88 'origin':20 'packet':17,45,52,54,58 'pars':15,38 'parser':3,8,154 'pcap':1,7,16,40,153 'pcap-pars':6 'pcapng':100 'primarili':85 'protocol':107 'provid':103 'publish':21 'purpos':132 'raw':37 'releas':110 'requir':92 'specif':130 'stabl':28 'strict':60 'support':61,97 'updat':121 'version':29,63","created_at":"2026-04-20T01:56:08.297384+00:00","updated_at":"2026-04-20T01:56:08.297384+00:00","problems":[{"fix":"Ensure you are using `new pcapp.Parser()` with a capital 'P' for the constructor.","cause":"Attempting to use `new pcapp.parser()` or `pcapp.default()` instead of `new pcapp.Parser()`.","error":"TypeError: pcapp.Parser is not a constructor"},{"fix":"Verify that the file path provided to the `pcapp.Parser` constructor is correct and that the Node.js process has read permissions for the file.","cause":"The specified PCAP file path does not exist or is inaccessible.","error":"Error: ENOENT: no such file or directory, open '/path/to/nonexistent.pcap'"},{"fix":"Run `npm install pcap-parser` in your project directory to ensure the package is installed and available.","cause":"The `pcap-parser` package has not been installed or is not resolvable from the current working directory or `NODE_PATH`.","error":"Error: Cannot find module 'pcap-parser'"}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":"","cli_version":null,"type":"library","homepage":null,"github":"https://github.com/nearinfinity/node-pcap-parser","docs":null,"changelog":null,"pypi":null,"npm":"https://www.npmjs.com/package/pcap-parser","openapi_spec":null,"status_page":null,"smithery":null,"categories":["serialization","http-networking"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-17","next_check":"2026-07-18","install_tag":null}}