Pcap.net vs Sharppcap

Question

I just want to listen a network device, capture packets and write the packets to a dummy file. Also i need to filter packets while listening so ill only write packets which passes the filter. I need to do these on .net c#. These are my requirements. So which one should i use? High transfer rate and minimum packet loss is really important. Thanks for reading.

Answer 1

As the author of SharpPcap I can say that you'll be able to perform all of those operations with the library. Performance was a critical design goal.

Packet.Net has a range of packets that it can parse and is the library bundled along with SharpPcap for packet dissection and generation. It's architecture does lazy evaluation anywhere it is possible in order to be as fast as possible.

Performance is tricky, especially because network packet capture is often a lower priority task for an operating system. The faster your application handles the packet the more packets can be handled without drops. I've been able to capture 3MB/s of packets without any drops. I haven't tried it at higher data rates or written extensive tests to generate and capture data in order to evaluate performance. Tests and real world results are welcome data points to be added to the documentation and website though.

Answer 2

The entire functionality is available in Pcap.Net.

Pcap.Net uses C++/CLI to wrap WinPcap, which is considered more efficient than PInvoke.

The packet library in Pcap.Net is quite big and complex packets can be parsed and created. This includes recursive layers like IP over IP. Parsing of each layer is done lazily and only when you need it.

For your needs, I see only benefits of using Pcap.Net over SharpPcap.