Home

This is the official homepage for packetq, a simple tool to make SQL-queries agains PCAP-files, making packet-analysis and building statistics simple and quick. Packetquery was previously know as DNS2db but was renamed in 2011 when it was rebuilt to handle other protocols than DNS.

Basics

Look how easy it's to count DNS-packets in a PCAP-file.

# packetq -s "select count(*) as count_dns from dns" packets.pcap 
[{"table_name": "result",
    "head": [ { "name": "count(1)","type": "int" } ],
    "data": [ 
[94761] 
]}]

Read more in our [[FAQ and Examples]] section below.

# Features
* Super-fast native decoding of PCAP-files (even gzipped) and dirt-quick in-memory sorting algorithms. 
* A extensible protocol decoding design with build in support for ICMP and DNS from start.
* Support for grouping, sorting, counting and most other important SQL-functions.
* Only dependent on zlib, no other hard-to-find libs needed. Compiles on everything.
* Build-in web-server, JSON API and a simple JQuery-based GUI concept application with graphs.
* Can be designed to cache queries by pre-processing PCAPs into static JSON-files that can be used to make queries again.
* Built in DNS-resolver function (used by GUI).
* Support for sampling. Helps when making queries to large, uniform PCAP-files.
* Can convert flags in packet-headers to text on the fly.
* Can make multiple queries towards the same data in memory.

# FAQ and Examples

## How do I return full packetdata for the first 3 dns packets?
Use this SQL-statement.

packetq -s "select * from dns limit 3" packets.pcap

Or to check which name is queried the most.

# packetq -s "select count(*) as count_dns from dns" packets.pcap 
[[ "count_dns" ],
[122537]] 

And which server that makes the most queries.

# packetq -s "select count(*) as count_dns from dns" packets.pcap 
[[ "count_dns" ],
[122537]] 

Or a list of the most

# packetq -s "select count(*) as count_dns from dns" packets.pcap 
[[ "count_dns" ],
[122537]]