seladb/PcapPlusPlus v26.07

July 2026 Release

on GitHub

July 2026 release of PcapPlusPlus (v26.07)

Binaries included in this release

• Binaries compiled for Ubuntu 26.04 LTS, 24.04 LTS, 22.04 LTS
  • For Ubuntu 26.04 both x86_64, ARM and Intel ICPX packages are available
• Binaries compiled for RHEL 9.4
• Binaries compiled for Fedora 42
• Binaries compiled for Alpine 3.20
• Binaries compiled for macOS Intel and Apple Silicon with Xcode 26 (clang 21.0.0) and 16 (clang 17.0.0)
• Binaries compiled for Android with all 4 ABIs: arm64-v8a, armeabi-v7a, x86, x86_64
• Binaries compiled for FreeBSD 14.1 and 13.4
• Binaries compiled for Windows using MinGW-w64 15.2.0 (32bit + 64bit)
• Binaries compiled for Windows using Microsoft Visual Studio 2026 (32bit + 64bit, Debug + Release configurations)
• Full documentation (both PcapPlusPlus website and API doxygen documentation) is available here: https://pcapplusplus.github.io/docs/quickstart

What's changed (changes from v25.05)

• libpcap / WinPcap / Npcap is now optional. Pcap++ no longer has a hard dependency on a packet-capture engine. Separately, Common++/Packet++ can now be built entirely on their own, without Pcap++. As part of this work, PcapPlusPlus can now read and write .pcap files without libpcap (thanks @Dimi1010 for the follow-up performance fixes and keeping this working across build configs!)
  • Note that the official pre-built packages are still built with libpcap / WinPcap / Npcap support enabled, so if you're using those you'll still need it installed. This change is primarily relevant if you're building PcapPlusPlus from source
• Bumped the minimum required C++ standard to C++14 (thanks @Dimi1010 !)
• Protocol support:
  • Added Modbus protocol (thanks @yahyayozo !)
  • Added DoIP – Diagnostic over Internet Protocol (thanks @raissi-oussema !)
  • Added PostgreSQL Wire Protocol (PGWire), including additional message types (thanks @Mfon-19 for a follow-up refactor!)
  • Added MySQL Wire Protocol
  • Discrete FTPControl and FTPData protocol types (thanks @Dimi1010 !)
  • Add support for AccurateECN TCP flag (thanks @turtleman123 !)
  • Improve SIP packet detection using heuristic parsing (thanks @sorooshm78 !)
  • Recognize LLC payload in SLL2 (thanks @Dimi1010 !)
• Added extensive X.509 / cryptography support:
  • X.509 certificate decoding, extension parsing, and parsing of X.509 certificates embedded in SSL/TLS messages
  • Export/import of X.509 certificates to PEM format, plus a new general-purpose PEM codec
  • Cryptographic key decoders (RSA/EC private and public keys)
  • Base64 encoding/decoding
  • A new X509Toolkit example application
  • Expanded ASN.1 codec support: BitString, UTCTime/GeneralizedTime, ObjectIdentifier and string records, plus arbitrary-size integer support (thanks @Dimi1010 for internal Asn1Codec/Asn1Record improvements along the way!)
• Added support for WinDivert as a packet capture engine on Windows
• Added support for DPDK 25.11, plus new dedicated DPDK CI tests (thanks @minhnhatnoe for an rte_eal_cleanup fix on device destruction!)
• IFileReaderDevice::createReader() and IFileReaderDevice::tryCreateReader() use file-content heuristics to automatically pick the right reader (pcap/pcapng/snoop) instead of relying solely on the file extension (thanks @Dimi1010 !)
• Add incremental packet parsing support with Packet::parsePacket() (thanks @Dimi1010 !)
• Added multi-language README support: Japanese (thanks @tigercosmos !) and Russian (thanks @camelsayswhat !) - in addition to the existing Traditional Chinese and Korean translations
• AI/LLM support: added AGENTS.md to make it easier for LLMs to work on PcapPlusPlus, added translation/ai_translation_prompt.md to use AI to maintain the README translations (thanks @tigercosmos !)
• IPv4Address/IPv6Address/MacAddress user-defined literals, e.g. constructing addresses directly from string literals, and sized buffer-construction overloads (thanks @Dimi1010 !)
• Explicit-ownership overloads for RawPacket::setRawData(), and a sized overload for Layer::copyData() (thanks @Dimi1010 !)
• Improved zstd support: added a build flag to control zstd support (thanks @Dimi1010 !), fixed compression level not being applied consistently (thanks @MerinoSheep !), and fixed a memory leak when reading zstd-compressed files (thanks @SuperBigYB !)
• A new SuppressLogs RAII class for temporarily suppressing log output (thanks @Dimi1010 !)
• Platform/CI updates: added Ubuntu 26.04 support, removed Ubuntu 20.04, added macOS 26 support, and moved Windows CI to Visual Studio 2026 / Windows Server 2025 (thanks @Dimi1010 and @tigercosmos for CI work along the way!)
• Large-scale internal refactoring of the device layer (PcapLiveDevice, DpdkDeviceList, file readers/writers, statistics tracking), the logging infrastructure, and the packet parsing infrastructure, improving encapsulation, thread-safety, and maintainability (thanks @Dimi1010 for the bulk of this work, with additional C++ modernization from @tigercosmos, @adityaxa and @gyl30 !)
• Improved benchmarking: added a pure-parsing benchmark and extended benchmarks to support PcapNG and Snoop files (thanks @Dimi1010 !)
• Test refactoring: replace packet creation macros in with C++ functions (thanks @Dimi1010 !)
• Tons of security and correctness bug fixes (thanks @Dimi1010, @egecetin, @alacrity-aya, @gyl30, @SAY-5, @ZX41R, @danasana, @bratbiswas, @BohdanBuinich, @BraedonKlock, @KangLin, @sorooshm78, @turtleman123 !)

Breaking changes

• The minimum required C++ standard has been raised to C++14
• IPcapDevice has been removed; its logic now lives in PcapLiveDevice
• libpcap/WinPcap/Npcap is now an optional dependency — building without it disables Pcap++ capture features, though Common++/Packet++ (including pcap file I/O) remain fully usable
• Various internal APIs around device lists and statistics tracking were reworked as part of the refactoring above; this may affect code relying on undocumented internals

Deprecation list

• IPv6Address::copyTo() has been deprecated, please use IPv6Address::copyToNewBuffer() instead
• MacAddress::copyTo() has been deprecated, please use MacAddress::copyToNewBuffer() instead
• Asn1IntegerRecord::getValue() has been deprecated, please use Asn1IntegerRecord::getIntValue() instead
• RawPacket::getObjectType() has been deprecated due to unclear semantics
• RawPacket::setRawData() has been deprecated, please use the overload that takes takeOwnership parameter for explicit control
• RawPacket::initWithRawData() has been deprecated, please use RawPacket::setRawData() with takeOwnership=false instead
• SSLExtension::SSLExtension() has been deprecated, please use the constructor with bounded span instead
• Several TcpOptionBuilder constructors have been deprecated, please use the new constructors with TcpOptionEnumType instead
• TcpLayer::getTcpOption(TcpOptionType option) has been deprecated, please use the overload TcpLayer::getTcpOption(TcpOptionEnumType option) instead
• TcpLayer::removeTcpOption(TcpOptionType optionType) has been deprecated, please use the overload TcpLayer::removeTcpOption(TcpOptionEnumType optionType) instead
• MBufRawPacket::getObjectType() has been deprecated due to unclear semantics
• IFileReaderDevice::getReader() has been deprecated, please use IFileReaderDevice::tryCreateReader() instead
• PcapFileReaderDevice::isNanoSecondPrecisionSupported() has been deprecated, nanosecond precision is now natively supported by the internal parser and always returns true
• PcapFileWriterDevice::isNanoSecondPrecisionSupported() has been deprecated, nanosecond precision is now natively supported by the internal parser and always returns true
• BpfFilterWrapper::matchPacketWithFilter() has been deprecated, please use BpfFilterWrapper::matches() instead
• GeneralFilter::matchPacketWithFilter() has been deprecated, please use GeneralFilter::matches() instead
• PcapLiveDevice::matchPacketWithFilter() has been deprecated, please use GeneralFilter::matches() directly
• PcapLiveDevice::sendPacket(Packet* packet, bool checkMtu = true) has been deprecated, please use PcapLiveDevice::sendPacket(Packet const& packet, bool checkMtu) instead
• PcapRemoteDeviceList::getRemoteDeviceByIP() has been deprecated, please use PcapRemoteDeviceList::getDeviceByIP() instead
• PfRingDeviceList::getPfRingDeviceByName() has been deprecated, please use PfRingDeviceList::getDeviceByName() instead

Collaborators

• @Dimi1010
• @tigercosmos
• @egecetin
• @clementperon
• @seladb

Full Changelog: v25.05...v26.07