33 releases

0.9.2 Apr 14, 2022
0.9.1 Nov 7, 2021
0.9.0 Sep 12, 2021
0.8.1 Dec 30, 2020
0.1.0 Mar 26, 2015

#80 in Network programming

Download history 3367/week @ 2022-04-21 3259/week @ 2022-04-28 3100/week @ 2022-05-05 3696/week @ 2022-05-12 3693/week @ 2022-05-19 3385/week @ 2022-05-26 3427/week @ 2022-06-02 3033/week @ 2022-06-09 3281/week @ 2022-06-16 3580/week @ 2022-06-23 3278/week @ 2022-06-30 4264/week @ 2022-07-07 3091/week @ 2022-07-14 3781/week @ 2022-07-21 4387/week @ 2022-07-28 3623/week @ 2022-08-04

15,445 downloads per month
Used in 33 crates (30 directly)


1.5K SLoC

pcap Build status Crates.io Docs.rs


This is a Rust language crate for accessing the packet sniffing capabilities of pcap (or wpcap on Windows). If you need anything feel free to post an issue or submit a pull request!


  • List devices
  • Open capture handle on a device or savefiles
  • Get packets from the capture handle
  • Filter packets using BPF programs
  • List/set/get datalink link types
  • Configure some parameters like promiscuity and buffer length
  • Write packets to savefiles
  • Inject packets into an interface

See examples for usage.


As of 0.8.0 this crate uses Rust 2018 and requires a compiler version >= 1.40.0.

As of 0.9.0 the capture-stream feature requires a compiler version >= 1.45.0.

As of 0.9.2 the capture-stream feature requires a compiler version >= 1.49.0.


Install WinPcap.

Download the WinPcap Developer's Pack. Add the /Lib or /Lib/x64 folder to your LIB environment variable.


On Debian based Linux, install libpcap-dev. If not running as root, you need to set capabilities like so: sudo setcap cap_net_raw,cap_net_admin=eip path/to/bin

Mac OS X

libpcap should be installed on Mac OS X by default.

Note: A timeout of zero may cause pcap::Capture::next to hang and never return (because it waits for the timeout to expire before returning). This can be fixed by using a non-zero timeout (as the libpcap manual recommends) and calling pcap::Capture::next in a loop.

Library Location

If LIBPCAP_LIBDIR environment variable is set when building the crate, it will be added to the linker search path - this allows linking against a specific libpcap.

Library Version

The crate will automatically try to detect the installed libpcap/wpcap version by loading it during the build and calling pcap_lib_version. If for some reason this is not suitable, you can specify the desired library version by setting the environment variable LIBPCAP_VER to the desired version (e.g. env LIBPCAP_VER=1.5.0). The version number is used to determine which library calls to include in the compilation.

Optional Features


Use the capture-stream feature to enable support for streamed packet captures. This feature is supported only on ubuntu and macosx.

pcap = { version = "0.9", features = ["capture-stream"] }


Licensed under either of

at your option.


Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.


~98K SLoC