I was chatting with a colleague a while ago, and they wanted to run some SQL queries against a PCAP – aggregate by source IP, that sort of thing. They went looking and found PacketQ (DNS/ICMP only), Apache Drill's PCAP support (outer headers only), DuckDB has a PCAP reader community extension (same deal, limited to outer headers). You can always write a one-off script with scapy or gopacket, but it gets old fast.
We deal a lot with tunneled traffic, none of those tools really seemed very feature rich on that front, e.g. for VXLAN every tool just showed UDP/4789, not the encapsulated packets.
So as a weekend project that got a bit out of hand, I built what they were asking for. Protocol layers become tables, you query with SQL, it parses through tunnels:
-- Traffic inside VXLAN tunnels
SELECT ip4_to_string(src_ip) as src, ip4_to_string(dst_ip) as dst, COUNT(*)
FROM ipv4
WHERE tunnel_type = 'vxlan'
GROUP BY 1, 2;
-- Top talkers
SELECT ip4_to_string(src_ip) as src, SUM(total_length) as bytes
FROM ipv4
GROUP BY 1
ORDER BY bytes DESC
LIMIT 10;
Built with Rust on Apache Arrow and DataFusion.