pcap

Tool tools/formats/pcap.py (program, Formats). Read a network capture (.pcap or .pcapng, from Wireshark or tcpdump) and split it into the conversations of a game: who talks to whom, on which ports, and the bytes of each message.

Run it with ./gameframe run pcap ARGS or python3 tools/formats/pcap.py. Source on GitHub.

Its own help

This is the help text in the tool itself, as ./gameframe tool pcap prints it.

Read a network capture (.pcap or .pcapng, from Wireshark or tcpdump) and split it into the
conversations of a game: who talks to whom, on which ports, and the bytes of each message.

Usage: pcap.py CAPTURE                          the flows: endpoints, protocol, packets, bytes
       pcap.py CAPTURE --flow N [--dir a|b]      the messages of flow N, with a hex preview
       pcap.py CAPTURE --flow N --dump DIR       each message as a file (for fields.py), in order
       pcap.py CAPTURE --flow N --stream OUT     a TCP flow's bytes joined into one stream file

A multiplayer game's protocol is the only record of how its clients and server talked. When
the server is gone, a capture made while it ran (yours, or one the community kept) is the
evidence for rebuilding it. Capture on the loopback interface while the game talks to a local
server, or on the network interface for an online game. Then list the flows, pick the game's,
and study its messages with tools/formats/fields.py, which finds the counters, lengths and
types in them.

UDP messages are kept one per datagram. TCP has no message boundaries: --dump writes each
segment that carries data, which is often one message, and --stream joins a direction's
segments in sequence order, for a protocol with its own length fields. Ethernet, Linux
"cooked" and loopback captures are read, with IPv4 and IPv6. Captures are game material when
they hold the game's data: keep them in derived/. Standard library only.

Named by

Skills: re-observe.