A MoonBit pcap Module Lets You Inspect Every Network Call Your Windows PC Makes
Packet capture on Windows has long meant bundling Npcap's SDK or reaching for heavyweight cross-platform libraries. A language-native module that loads the driver dynamically lowers the setup tax for diagnostics, network debugging, and background-traffic auditing in MoonBit projects.
The `chensuiyi/pcap` module gives MoonBit programs direct access to raw network traffic on Windows by dynamically loading the system's Npcap driver at runtime. No development SDK is needed — just install the Npcap driver itself, and the module finds `wpcap.dll` on its own. The API distills packet capture into four calls: load the driver, enumerate network interfaces, open a device, and loop through incoming packets. Each captured packet surfaces a timestamp, capture length, original wire length, and the full raw byte payload. The module targets Windows 10 and 11 and may require administrator privileges depending on the system configuration. MoonBit itself compiles to WebAssembly and positions itself for cloud-native workloads, with a syntax that borrows from Rust but aims for less ceremony.
Dynamic loading of `wpcap.dll` sidesteps the usual compile-time linking and SDK dependency that make quick packet-capture scripts on Windows cumbersome.
Exposing raw byte payloads alongside metadata means the module is useful beyond simple traffic logging — it can feed into protocol parsers or custom intrusion-detection heuristics written in MoonBit.
The module's narrow Windows-only scope is a deliberate trade-off: it avoids the abstraction overhead of cross-platform capture libraries in exchange for a simpler integration path on one OS.