Welcome! You're looking at the manual for Netdude, the NETwork
DUmp data Displayer and Editor. Thanks for reading this.
tcpdump tracefiles and their corresponding tcpdump output are among the
standard means to handle captured network traffic, illustrate networking
issues and test networking applications with repeatable traffic patterns.
All these situations require handling tcpdump tracefiles, which can be large,
complex and hard to inspect. Handling these files is usually done
through code, which will generally be of similar structure:
Open the tracefile using pcap_open_offline().
Iterate over the packets in the trace using pcap_dispatch()
or pcap_loop(), optionally using a pcap filter.
In the pcap handler, inspect the packet data manually and cast
offsets into the data into various protocol header struct pointers
to access and/or modify the captured data.
If the packet data gets modified, the packet is writting out to a
new tracefile using pcap_dump().
Writing this code is boring, almost identical for each tool coded and
The aim of Netdude is to make this stuff easy and provide a framework
for both programmatical and GUI-based manipulation of tracefiles. Using
the Netdude GUI, you can
Edit multiple traces at the same time, making it easy to move
packets from one trace to a different one.
Modify every field in protocol headers for which a protocol plugin
Edit arbitrary packet content using Netdude's hex editor in both
hex- or ASCII-mode, whichever is more convenient for the payload
Move packets around, duplicate them, remove them from traces.
Instantly see the tcpdump output update according to the modifications
Conveniently use the clipboard to select lines from the tcpdump
output for situations when you need the tcpdump output, but not
the packet data that's underneath, like when writing documentation,
papers or emails.
Where Netdude's functionality doesn't suffice for your needs, you can
write a plugin. Plugins in Netdude currently have full access to the
Netdude core and can do anything with the packets. There are two kinds
Protocol Plugins: Editing packets using
a hex editor is cumbersome. If you need convenient access to
packet data, consider writing a protocol plugin. The plugin
gets registered in Netdude's protocol registry automatically,
all you need to do is provide a bunch of callbacks. The set
of callbacks provides support for both state-free and stateful
Functionality Plugins: If the problem isn't
support for a protocol but the need to do something that Netdude
currently cannot do, you can write a plugin providing that
feature. Those plugins support a single big entry point that
gets called from a menu item and can do anything you desire,
be that correcting checksums, anonymizing data, statistical
Netdude provides simple-to-use abstractions for accessing headers
in packets, iterate over packets, create and delete traces etc.