GCap - Real-time Network Packet Sniffer

A high-performance, real-time network packet analyzer built with Go (Fiber) and Vanilla JS/Tailwind. Designed for speed, concurrency, and a modern "Wireshark-like" web interface.

🚀 Features

• Real-time Capture: Live streaming of network packets via WebSockets.
• High Performance: Powered by Go's lightweight goroutines and gopacket.
• Modern UI: Dark-mode dashboard with Tailwind CSS.
• Protocol Analysis: Automatic detection and color-coding for TCP, UDP, and ICMP.
• Interactive Controls: Pause/Resume live feed without stopping the backend.
• PCAP Export: Buffer and download captured packets for analysis in Wireshark.
• Multi-Client: Broadcast architecture supports multiple simultaneous UI connections.

🏗 Architecture

graph TD
    subgraph "Backend (Go)"
        A[Network Interface / Mock] -->|Raw Bytes| B(Sniffer Goroutine)
        B -->|Metadata| C{Packet Channel}
        B -->|Raw Data| D[Ring Buffer]
        C -->|Stream| E[Hub / Broadcast]
        D -->|Save| F[PCAP Generator]
    end

    subgraph "Frontend (Browser)"
        E -->|WebSocket| G[Web UI]
        G -->|Commands| E
        G -->|Download| F
    end

    style A fill:#f9f,stroke:#333,stroke-width:2px
    style E fill:#ccf,stroke:#333,stroke-width:2px
    style G fill:#bfb,stroke:#333,stroke-width:2px

Loading

🛠 Setup & Run

Prerequisites

• Go 1.21+
• libpcap-dev (Linux) / npcap (Windows)

Installation

git clone https://github.com/yourusername/gcap.git
cd gcap

# Install dependencies
go mod tidy

Running

Note: Raw socket access typically requires root permissions. If running without root, the system defaults to Simulation Mode (generating realistic dummy traffic).

# default interface (eth0)
sudo go run main.go

# Run on specific interface
sudo go run main.go wlan0

Open your browser to: http://localhost:3000

📂 Project Structure

gcap/
├── main.go
├── sniffer/
│   └── sniffer.go
├── public/
│   └── index.html
├── go.mod
└── README.md