moonbit-pcap

Pure MoonBit network packet capture (PCAP / PCAPNG) parser, stream reassembly, and multi-protocol analyzer library

pcap
pcapng
network
packet
protocol
reassembly
tcp
dns
moon add cghyyrrt/moonbit-pcap@0.1.1
Download zip
Author
Version
0.1.1
License
Apache-2.0
Last updated
4 hours ago
Downloads
4
README

#moonbit-pcap

Pure MoonBit packet-capture parsing and network analysis for PCAP and PCAPNG data. The library has no libpcap or C runtime dependency and is suitable for offline analysis, embedded tooling, CLI utilities, and WebAssembly hosts.

License CI

#Features

  • Endian-aware binary readers, writers, cursors, queues, checksums, CRCs, hex, Base64, and bounded varints.
  • Classic PCAP and PCAPNG readers and writers with structural validators.
  • Ethernet, VLAN, ARP, IPv4, IPv6 extensions, ICMP, ICMPv6, TCP, UDP, SCTP, DNS, HTTP, MQTT, CoAP, CAN, Modbus TCP, PROFINET, EtherNet/IP, and DNP3 parsing.
  • Bounded TCP stream, UDP flow, and IP fragment reassembly.
  • Traffic statistics, time series, RTT, bandwidth, filtering, packet classification, anomaly detection, and Markdown/JSON/CSV/HTML/text export.
  • CLI and WebAssembly integration points.

#Requirements

  • MoonBit stable toolchain (the CI installs the current stable release).
  • No native packet-capture library is required.

#Installation

Add the package to a MoonBit module:

moon add cghyyrrt/moonbit-pcap

Then import the package you need:

import "cghyyrrt/moonbit-pcap/src/pcap"
import "cghyyrrt/moonbit-pcap/src/layers"

fn inspect_capture(bytes : Bytes) -> Int {
match @pcap.PcapReader::new(bytes) {
Some(reader) => reader.read_all().length()
None => 0
}
}

#Package layout

PackageResponsibility
src/binarySafe binary I/O, cursors, queues, checksums, CRCs, and encoders
src/pcapClassic PCAP headers, packets, writer, validator, and filters
src/pcapngPCAPNG blocks, options, writer, and validator
src/layersLink, network, transport, application, and industrial protocols
src/reassemblyTCP, UDP, IP-fragment, and bounded stream reassembly
src/analyzerStatistics, sessions, rates, reports, and anomaly detection
src/exporterJSON, CSV, HTML, terminal, and Markdown reports
src/cliCommand-line analysis pipeline
src/wasmWebAssembly-facing integration functions

#Validation

Run the same checks locally as CI:

moon fmt --check moon check --deny-warn --target all moon test --deny-warn powershell -NoProfile -ExecutionPolicy Bypass -File scripts/source-metrics.ps1 moon bench benchmarks

The source metric script counts only handwritten .mbt files under src/ and cmd/; generated _build/ files are excluded. The current verified metric is available from the script output rather than maintained as an unchecked claim.

The benchmark uses a fixed 42-byte Ethernet/IPv4/UDP frame. See benchmarks/README.md for the command and the latest measured local result.

#Command-line usage

Build and run the example executable:

moon run cmd/main -- --help

The CLI pipeline reads a capture, analyzes packet and protocol statistics, and can emit the library's report formats. Library packages can also be composed directly when an application needs custom ingestion or filtering.

#WebAssembly

The src/wasm package exposes small host-friendly functions for browser or embedded WebAssembly integrations. Build it with the stable WebAssembly target supported by the installed MoonBit toolchain.

#Continuous integration

GitHub Actions runs stable MoonBit checks on Ubuntu, macOS, and Windows. It checks formatting, all supported compile targets, the default test target, and native tests on Unix runners. The workflow also verifies that formatting does not modify tracked source.

#Publishing

Package publishing is a manual GitHub Actions workflow. It performs the same pre-publish checks and reads a Mooncakes token from the repository secret MOONCAKES_TOKEN; credentials are never committed to the repository.

#Contributing

Please add a focused test for parser behavior and malformed-input handling, run the validation commands above, and keep public types in the package that owns their API. Changes should remain independent of native packet-capture libraries.

#License

Apache License 2.0. See LICENSE.

Powered by MoonBit

Site sourceReport issuePackagesBuild queueSkillsStatistics

© 2026 mooncakes.io