Network Protocol Analyzer

A C++ console application for live network packet capture and protocol analysis on Windows. It uses Npcap to sniff traffic from a selected network interface, classifies IPv4 packets by protocol, and displays real-time statistics in the terminal.

Features

• Live packet capture — Select a network adapter and capture traffic in real time
• Protocol classification — Parses Ethernet and IPv4 headers; counts TCP, UDP, ICMP, and other packets
• Real-time dashboard — Console UI with runtime metrics, protocol distribution bars, and an ASCII bandwidth graph
• Demo mode — Run without a network adapter using simulated traffic to preview the visualization

How it works

1. The application lists available network devices via pcap_findalldevs.
2. You choose an interface to monitor.
3. PacketCapture opens the device with pcap_open_live and processes each frame in a capture loop.
4. Each packet is parsed at the Ethernet and IP layers; the IP protocol field drives TCP/UDP/ICMP classification.
5. Every 10 packets, NetworkVisualizer refreshes the terminal with updated metrics and charts.
6. Press Ctrl+C to stop capture and view final statistics.

Project structure

Network-Protocol-Analyzer/
├── CMakeLists.txt
├── include/
│   ├── PacketCapture.h       # Capture engine and PacketStats
│   └── NetworkVisualizer.h   # Terminal dashboard and charts
└── src/
    ├── main.cpp              # Device selection and live capture entry point
    ├── PacketCapture.cpp     # Packet parsing and statistics
    ├── NetworkVisualizer.cpp # Real-time console visualization
    └── demo.cpp              # Simulated traffic demo (Demo target)

Tech stack

Component	Technology
Language	C++17
Build system	CMake 3.10+
Packet capture	Npcap SDK (libpcap-compatible API)
Platform	Windows (Npcap, Winsock2)

Prerequisites

1. Npcap — Install the Npcap driver (not WinPcap). During setup, enable WinPcap API-compatible Mode if prompted.

2. Npcap SDK — Download the Npcap SDK and extract it. The default CMake configuration expects it at:

   C:/npcap-sdk-1.15/
   

   If your SDK is elsewhere, update the include_directories and link_directories paths in CMakeLists.txt.

3. CMake and a C++17 compiler (Visual Studio 2019+ recommended on Windows).

Note: Live packet capture requires running the executable as Administrator.

Build

From the project root:

cmake -S . -B build
cmake --build build --config Release

Binaries are written to:

build/Release/NetworkProtocolAnalyzer.exe
build/Release/Demo.exe

For Debug builds, use --config Debug and look under build/Debug/.

Usage

Live capture

Run as Administrator:

.\build\Release\NetworkProtocolAnalyzer.exe

1. Select a network device from the numbered list.
2. Watch the real-time dashboard update as packets are captured.
3. Press Ctrl+C to stop and print final statistics.

Visualization demo

No admin rights or network adapter required:

.\build\Release\Demo.exe

This generates simulated TCP/UDP/ICMP traffic and drives the same dashboard used in live capture.

Dashboard output

The terminal UI includes:

• Network metrics — Total packets, packets/sec, average packet size, bandwidth (bps)
• Protocol distribution — Percentage bars for TCP, UDP, ICMP, and other traffic
• Bandwidth history — ASCII chart of recent bytes/sec measurements

Limitations

• Windows-only (Npcap/Winsock dependencies)
• IPv4 over Ethernet only; IPv6 and non-Ethernet frames are counted as Other
• No packet logging or pcap file export
• Npcap SDK path is hardcoded in CMakeLists.txt

Roadmap

• Configurable Npcap SDK path via CMake variable or environment variable
• IPv6 and additional link-layer support
• Export capture statistics to CSV or JSON
• Optional pcap file input mode for offline analysis
• Cross-platform support (libpcap on Linux/macOS)
• Unit tests for packet parsing logic

License

This project is licensed under the MIT License. You are free to use, modify, and distribute the code with attribution.