How snehify/packetdetective works
This Java packet-inspection application reads classic PCAP files, parses packets, distributes IP traffic across worker threads, classifies connections using payload clues, applies blocking rules, and writes forwarded packets to a new PCAP. It also provides a packet-summary command. The principal flow is visible in the DPI engine and worker excerpts; alternate entry points and other capabilities are represented only where the source index or excerpts establish them.
Main entry points: DPIEngine.java DPI engine · FastPathProcessor.java Fast-path workers · MainPacketSummary.java Packet summary · PacketParser.java Packet parser
Components 14
Command entry points
- DPI command
external/dcpappi/src/Main.java - Packet summary
external/dcpappi/src/MainPacketSummary.java
PCAP processing
- DPI engine
external/dcpappi/include/DPIEngine.java - PCAP reader
external/dcpappi/include/PcapReader.java - Packet parser
external/dcpappi/include/PacketParser.java - Output PCAP
Parallel inspection
- Load balancer
external/dcpappi/include/LoadBalancer.java - Fast-path workers
external/dcpappi/include/FastPathProcessor.java
Classification and policy
- Connection tracker
external/dcpappi/include/ConnectionTracker.java - Payload classification
external/dcpappi/include/SNIExtractor.java - Blocking rules
external/dcpappi/include/RuleManager.java
Shared runtime
- Work queues
external/dcpappi/include/ThreadSafeQueue.java - Packet and flow types
external/dcpappi/include/Types.java
Other components
- Operator
Connections 20
- Operator → DPI command: runs
external/dcpappi/src/Main.java - Operator → Packet summary: runs
external/dcpappi/src/MainPacketSummary.java - DPI command → DPI engine: initializes and processes
external/dcpappi/src/Main.java - Packet summary → PCAP reader: reads packets
external/dcpappi/src/MainPacketSummary.java - Packet summary → Packet parser: parses packets
external/dcpappi/src/MainPacketSummary.java - DPI engine → PCAP reader: reads input
external/dcpappi/include/DPIEngine.java - DPI engine → Packet parser: parses packets
external/dcpappi/include/DPIEngine.java - DPI engine → Load balancer: dispatches jobs
external/dcpappi/include/DPIEngine.java - DPI engine → Fast-path workers: starts and stops
external/dcpappi/include/DPIEngine.java - DPI engine → Blocking rules: loads rules
external/dcpappi/include/DPIEngine.java - DPI engine → Work queues: queues output
external/dcpappi/include/DPIEngine.java - DPI engine → Output PCAP: writes forwarded packets
external/dcpappi/include/DPIEngine.java - Load balancer → Work queues: dispatches jobs
external/dcpappi/include/LoadBalancer.java - Fast-path workers → Work queues: consumes jobs
external/dcpappi/include/FastPathProcessor.java - Fast-path workers → Connection tracker: tracks flows
external/dcpappi/include/FastPathProcessor.java - Fast-path workers → Payload classification: extracts host clues
external/dcpappi/include/FastPathProcessor.java - Fast-path workers → Blocking rules: checks policy
external/dcpappi/include/FastPathProcessor.java - Packet parser → Packet and flow types: creates packet jobs
external/dcpappi/include/PacketParser.java - Connection tracker → Packet and flow types: stores connection state
external/dcpappi/include/ConnectionTracker.java - Blocking rules → Packet and flow types: uses app types
external/dcpappi/include/RuleManager.java