NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ ">


Welcome! You're looking at the manual for Netdude, the NETwork DUmp data Displayer and Editor. Thanks for reading this.

What Is Netdude?

tcpdump tracefiles and their corresponding tcpdump output are among the standard means to handle captured network traffic, illustrate networking issues and test networking applications with repeatable traffic patterns.

All these situations require handling tcpdump tracefiles, which can be large, complex and hard to inspect. Handling these files is usually done through code, which will generally be of similar structure:

Writing this code is boring, almost identical for each tool coded and time-consuming. The aim of Netdude is to make this stuff easy and provide a framework for both programmatical and GUI-based manipulation of tracefiles. Using the Netdude GUI, you can

  • Edit multiple traces at the same time, making it easy to move packets from one trace to a different one.

  • Modify every field in protocol headers for which a protocol plugin provides support.

  • Edit arbitrary packet content using Netdude's hex editor in both hex- or ASCII-mode, whichever is more convenient for the payload you're editing

  • Move packets around, duplicate them, remove them from traces.

  • Instantly see the tcpdump output update according to the modifications you're making.

  • Conveniently use the clipboard to select lines from the tcpdump output for situations when you need the tcpdump output, but not the packet data that's underneath, like when writing documentation, papers or emails.

Where Netdude's functionality doesn't suffice for your needs, you can write a plugin. Plugins in Netdude currently have full access to the Netdude core and can do anything with the packets. There are two kinds of plugins:

Netdude provides simple-to-use abstractions for accessing headers in packets, iterate over packets, create and delete traces etc.



The TCP plugin that comes with Netdude uses its own system to monitor TCP connection state in order to provide correct seq/ack numbers in the tcpdump output -- if you want that feature.