An Arduino library for creating and sending .pcap files from ESP8266/ESP32 to Wireshark for WiFi packet capture and analysis.
ArduinoPcap is an Arduino library that allows ESP8266 and ESP32 microcontrollers to capture WiFi packets and output them in the .pcap format, compatible with Wireshark. It enables embedded devices to act as low-cost network sniffers for monitoring WiFi traffic, detecting deauthentication attacks, or analyzing network behavior.
Embedded developers, security researchers, and hobbyists working with ESP8266/ESP32 who need to capture and analyze WiFi packets for projects like intrusion detection, network monitoring, or educational demonstrations.
It provides a simple, Arduino-compatible way to perform packet capture on affordable hardware, eliminating the need for expensive commercial sniffing tools. The library includes live Wireshark streaming and SD card logging, making it versatile for both real-time and offline analysis.
A library for creating and sending .pcap files for Wireshark and other programms.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Leverages affordable ESP8266 and ESP32 boards, making packet capture accessible for educational and hobbyist projects, as emphasized in the project's focus on simplicity and cost-effectiveness.
Includes a Python script (SerialShark.py) to stream packets directly to Wireshark over serial for real-time analysis, detailed in the extras folder, though it requires specific dependencies.
Allows saving captured packets to an SD card in .pcap format for offline inspection, with configurable intervals in the examples, enabling forensic analysis without continuous connectivity.
Supports channel hopping to capture packets across different WiFi channels, configurable in sketch settings like CHANNEL_HOPPING and HOP_INTERVAL, for broader network visibility.
The README admits that most packets captured on ESP8266 are malformed or cut off, limiting accuracy for detailed network analysis, though usable for basic tasks like MAC address detection.
The Serialshark script for live Wireshark capture does not work on Windows, restricting real-time streaming to Linux or macOS, as explicitly noted in the dependencies section.
Designed as a proof of concept with admitted errors, it lacks production reliability, which can lead to data loss or interruptions in critical monitoring scenarios.