A MoonBit pcap Module Lets You Inspect Every Network Call Your Windows PC Makes

Your computer is constantly online: watching videos, browsing web pages, sending messages, running background updates.

These online activities are essentially your computer exchanging data with remote servers.

The data being transmitted is called data packets on the network, like cars running on a highway.

Packet capturing is like standing by the road and recording each of these cars one by one: when they passed by, how big they are, and what they are carrying.

chensuiyi/pcap is a packet capturing module in the MoonBit language, specifically designed for this task.

It mainly solves three problems:

• Which servers the software on the computer is communicating with
• How large the communication volume is
• When the communication occurs

What are the prerequisites for packet capturing?

The Windows system itself cannot capture packets directly; it requires installing a driver called Npcap first.

It is the official packet capturing driver for Windows, equivalent to installing a "data packet toll station" on the system, through which all data passing through the network card must go.

After installing Npcap, programs can obtain raw data through it.

The chensuiyi/pcap module's job is to help MoonBit programs interface with Npcap.

It uses a runtime dynamic loading approach, where the program automatically searches for the wpcap.dll file in the system after starting.

Users of this module only need to install Npcap itself; no development kits are required.

How to download and install?

MoonBit is a new programming language with a syntax style similar to Rust but more concise. It compiles to WebAssembly with small size and fast speed, primarily targeting cloud-native scenarios.

Language documentation: https://docs.moonbitlang.com

The MoonBit toolchain can be installed on Windows with a single PowerShell command:

Set-ExecutionPolicy RemoteSigned -Scope CurrentUser; irm https://cli.moonbitlang.com/install/powershell.ps1 | iex

Verify the installation afterwards:

moon --version

If it outputs a version number, the installation is successful.

Then create a new project and import the packet capturing module:

moon new my-sniffer
cd my-sniffer
moon add chensuiyi/pcap

A complete example

The entire packet capturing process consists of only four steps: load, query network cards, open, and receive packets.

First, write a small program to view the list of network cards:

fn main {
  match @pcap.load() {
    Err(msg) => {
      println("Load failed: {msg}")
      return
    }
    Ok(_) => ()
  }
  let devs = @pcap.devices()
  for d in devs {
    println("{d.name} —— {d.description}")
  }
}

Run it:

moon run

You can see the names and descriptions of all network cards on the local machine.

Taking it a step further, open the first real network card, loop to receive packets, and print the arrival time and size of each packet:

fn main {
  match @pcap.load() {
    Err(msg) => {
      println("Load failed: {msg}")
      return
    }
    Ok(_) => ()
  }
  let devs = @pcap.devices()
  match @pcap.open(devs[0].name, 65535, true, 1000) {
    Err(msg) => println("Open failed: {msg}")
    Ok(pc) => {
      while true {
        match @pcap.next(pc) {
          Some(pkt) =>
            println("Time:{pkt.ts_sec}.{pkt.ts_usec} Length:{pkt.len} bytes")
          None => () // No data this second, keep waiting
        }
      }
    }
  }
}

After running, as long as there is network activity on the computer, the screen will continuously print information about newly captured data packets.

For each data packet received, you can get the following information:

Information	Description
Timestamp	When this packet passed by
Capture Length	The size of the data actually recorded
Original Length	How big this packet originally was
Raw Data	All the byte content inside the packet

What effects can be achieved?

When the network is lagging, you can use it to confirm whether any software is secretly uploading data in the background.

Write a small packet capturing program, and you can see which software, at what time, and how much data was transmitted.

When debugging network programs and encountering problems, you can use it to confirm whether data was actually sent out and whether the other party responded.

Run the packet capture continuously for a period, save the data, and you can even analyze the computer's main communication counterparts.

What should be noted when using this module?

• Operating system requires Windows 10 or 11.
• Npcap must be installed, official website: https://npcap.com
• Some systems require administrator privileges to run.

---

Thank you for reading. I am Chen Suiyi, the Tiger of Frontend. Official account 陈随易, personal website: https://chensuiyi.me.