Monitor and modify network packets in real time.
Monitor, analyze, and filter network packets across Windows, Linux, and macOS.
USE CASES
What you can build with PCAP Filter
Build network monitoring, security, and diagnostic tools with one API across Windows, Linux, and macOS.
Real-time network security tools
Block malicious packets, enforce bandwidth limits, or reroute sensitive traffic as it crosses the wire.
Custom packet sniffers
Build your own packet capture tool with familiar BPF filter syntax and a simple component API instead of raw socket code.
Compliance and audit logging
Capture and log network traffic for compliance, troubleshooting, or later analysis.
Cross-platform monitoring agents
Ship the same packet capture and filtering logic on Windows, Linux, and macOS from one codebase.
HOW IT WORKS
Capture packets through a driver. Filter and act on them through a component API.
PCAP Filter provides a user-mode component library API to easily leverage a driver that listens for traffic on the network interface. Instead of parsing raw packets yourself, your app gets that traffic through the component API.
Filter expressions use the same BPF syntax as libpcap, tcpdump, and Wireshark, so you can target exact traffic by IP, protocol, port, or direction without learning a new filter language.
With the NetFilter component, you can also modify or drop packets in real time, not just observe them. No low-level driver code required.
START BUILDING
Documentation & Resources
Online Documentation
Full API reference for all components and languages, with code examples for every method and event.
Read now
Knowledge Base
Troubleshooting guides, how-tos, and answers to common implementation questions.
Read nowGetting Started with NetFilter
A step-by-step guide to setting up NetFilter and using it to capture, filter, and modify network packets.
Read nowGetting Started with IPMonitor
A hands-on guide to setting up IPMonitor and using it to capture and monitor network packets across Windows, Linux, and macOS.
Read nowSample Applications
Shows how to use the NetFilter component to monitor and drop network packets.
Shows how to use the NetFilter component to monitor and drop network packets.
Shows how to use the NetFilter component to capture and parse DNS query and response packets.
Shows how to use the IPMonitor component to monitor network packets.
Shows how to use the NetFilter component to monitor and drop network packets.
FEATURES
Intercept and Adjust Network Traffic
Intercept and Adjust Network Traffic
Monitor network activity in real-time and react instantly. PCAP Filter’s flexible API lets your application capture exactly the packets you care about, ensuring you never miss critical events.
Modify Packets On-The-Fly
Alter packet contents or headers before they reach their destination. With the NetFilter component, your application can modify or drop packets in real-time—without the need to write low-level driver code.
Leverage Industry-Standard Filter Syntax
Employ the same filter expressions used by Wireshark and other pcap-based tools to target exactly the traffic you need. IPMonitor and NetFilter enable your application to capture packets by IP, protocol, port, or direction using a familiar filter syntax.
Zoom In or Zoom Out
Toggle between detailed per-packet inspection and high-level statistical analysis. Adapt your capture strategy as your diagnostic or auditing requirements change—without the need for significant code rewrites.
Implement Custom Security Policies
Block malicious packets, reroute sensitive data, or enforce bandwidth limits. PCAP Filter enables you to apply your own logic and safeguards to detect and respond to suspicious activity in real-time.
Audit and Log Network Activity
Maintain a detailed record of all captured traffic for compliance and diagnostics. Instantly access the data you need to identify issues and ensure regulatory adherence.
Avoid Low-Level Driver Code
Deliver robust network features without delving into kernel development. PCAP Filter abstracts away the heavy lifting, letting you focus on building innovative solutions rather than wrestling with OS-level details.
Streamline Cross-Platform Deployment
Write your code once and deploy it everywhere. PCAP Filter provides a single, consistent API across Windows, Linux, and macOS, freeing you to concentrate on delivering value rather than maintaining separate code paths.
PLATFORMS
Supported Languages & Operating Systems
Every edition ships with a pre-built driver, sample applications, and full documentation. 30-day fully functional trial for all editions.
PCAP Filter supports .NET Framework 4.0+ and .NET 5 through .NET 10, with full Visual Studio integration and C# sample applications.
Documentation
PCAP Filter ships 32-bit and 64-bit Windows DLLs and C++ libraries built for Linux and macOS, with no external runtime dependencies.
Documentation
PCAP Filter provides Java classes built on the same high-performance codebase as our native editions, with full Javadoc and seamless integration into IntelliJ and Eclipse.
Documentation
PCAP Filter ships as Python 3 modules for Windows, Linux, and macOS, installable via PIP with comprehensive HTML documentation and sample applications.
Documentation
PCAP Filter ships as Rust crates built on 32-bit and 64-bit shared libraries for Windows, Linux, and macOS, with support for x86/x64 and ARM.
Documentation
PCAP Filter provides high-performance Go packages built on the same C++ codebase as our native editions, supporting Go 1.13+ on Windows, Linux, and macOS.
Documentation
PCAP Filter provides native Delphi VCL components built on our shared codebase, supporting every Delphi version from Delphi 6 through RAD Studio 13.
Documentation
PCAP Filter ships as 32-bit and 64-bit Windows DLLs and C++ libraries for Linux, macOS, and FreeBSD, supporting Qt 4.8, Qt 5, and Qt Creator integration.
Documentation
PCAP Filter ships as a modern XCFramework for macOS, built for native Swift 5 and Objective-C development with full support for Intel and Apple Silicon in Xcode 13+.
DocumentationFAQ
Frequently Asked Questions
Common questions about licensing, integration, and deployment.
What is PCAP Filter?
PCAP Filter is a cross-platform SDK for capturing, filtering, and modifying network packets on Windows, Linux, and macOS. It ships a driver that listens on the network interface and surfaces traffic through a component API, so you get full packet visibility without writing kernel or socket-level code.
It's built on the same BPF filter engine as libpcap, so filter expressions work the same way they do in Wireshark and tcpdump. Two components cover the core use cases: IPMonitor for passive traffic capture, and NetFilter for capturing plus real-time packet modification and blocking.
How do I capture and filter network packets in C#, Python, or Go without writing a kernel driver?
PCAP Filter handles the driver and low-level capture work for you. Your app calls into the component API in .NET, C++, Python, Rust, Go, Java, Delphi, or Qt, sets a BPF filter expression to target the traffic you care about, and receives matching packets through callback events.
No raw sockets, no kernel driver development, no platform-specific capture code. The same API and filter syntax work across Windows, Linux, and macOS.
How does PCAP Filter relate to libpcap and Wireshark?
PCAP Filter uses the same BPF (Berkeley Packet Filter) expression engine that powers libpcap, tcpdump, and Wireshark. Filter syntax you already know from those tools, matching by IP, port, protocol, or direction, works the same way in PCAP Filter.
The difference is what you can do with traffic once it's captured. libpcap is capture-only. PCAP Filter's NetFilter component adds real-time packet modification and drop capability on top of the same familiar filtering model.
Can PCAP Filter modify or drop packets in real time?
Yes. The NetFilter component intercepts packets before they reach their destination, letting your app modify packet contents or headers, or drop packets outright, in real time. Useful for enforcing security policies, blocking malicious traffic, or reshaping data in flight.
If you only need to observe traffic without altering it, the IPMonitor component covers passive capture and analysis.
Which platforms does PCAP Filter support?
PCAP Filter supports Windows, Linux, and macOS, with one consistent API across all three. Language support includes .NET, C++, Python, Rust, Go, Java, Delphi, and Qt.
Start with a free 30-day trial
Fully functional, no feature restrictions. Free technical support from day one. No credit card required.
TRUSTED BY DEVELOPERS WORLDWIDE
Built for production. Proven at scale.
Components and drivers from Callback Technologies have been shipping in commercial products for over two decades, from single-developer tools to enterprise software deployed at Fortune 500 companies.
We would be glad to recommend your product. It is very intuitive, easy and comfortable to use. The code and license were delivered just an hour after payment. Your support is efficient. Thanks a lot!
I used this for several applications already. You've implemented it very efficiently. Lots of smart ideas without sacrificing reliability. All this at very reasonable price. Thank you.