libtins: C++ packet sniffing and crafting over libpcap, with configurable 802.11 and WPA2 support

C++ packet crafting and sniffing over libpcap, with platform and endianness independence

libtins is a multiplatform C++ library for network packet crafting, sniffing and analysis, built on libpcap. Its stated purpose is to give C++ developers an easy, efficient, platform and endianness-independent way to build tools that send, receive and manipulate specially crafted packets. Endianness independence means the library handles byte order conversions internally, so calling code does not need to account for differences between architectures.

libtins abstracts over libpcap, which handles the low-level capture and injection, adding a higher-level C++ interface for working with protocol headers and packet structures. Teams that already use libpcap directly and do not need that abstraction layer will find libtins adds a dependency without reducing complexity for their use case.

v4.6, released on 2026-08-05, is the current version. libtins is distributed under the BSD-2-Clause licence; the LICENSE file at the repository root has the full text.

Tutorials, examples and benchmarks not in the README are hosted at libtins.github.io.

Building from source with cmake: shared, static, installation and running tests

libtins depends on libpcap and, optionally, openssl. After satisfying those dependencies, the build follows the standard cmake sequence:

mkdir build
cd build
cmake ../
make

By default, the build produces only a shared object. To generate a static library instead, pass `LIBTINS_BUILD_SHARED=0` to cmake:

cmake ../ -DLIBTINS_BUILD_SHARED=0

Both the static and shared library files land in `build/lib`. To install headers and the shared object system-wide, run as root:

make install

After installation, update ldconfig's cache before linking against the library:

ldconfig

To run unit tests, first fetch the googletest submodule, then build and run them:

git submodule init
git submodule update

After fetching the submodule, `make tests` compiles the tests and `make test` runs them. The README asks anyone who finds failing tests to file a ticket indicating the platform and architecture.

LIBTINS_ENABLE_CXX11=1 is described as noticeably faster, with no benchmark attached

The README says libtins is noticeably faster when C++11 support is enabled, and recommends enabling it if the compiler supports that standard. No measurement or methodology accompanies the claim, and no specific operation is named as the beneficiary. Noticeably faster is the project's own characterization without a number.

cmake ../ -DLIBTINS_ENABLE_CXX11=1

For projects on a modern compiler where C++11 is the standard, this flag costs nothing to enable. For builds on older or embedded compilers, the flag is optional; the library functions without it. What the speedup applies to and by how much are not documented in the README.

3 optional feature flags control TCP, WPA2 and 802.11 support at compile time

Three cmake flags independently disable features, each with its own dependency effects.

TCP ACK tracking requires the boost.icl header-only library. This feature is enabled by default but disabled automatically if boost headers are not found. To disable it explicitly:

cmake ../ -DLIBTINS_ENABLE_ACK_TRACKER=0

When boost is at a non-standard path, the CMake FindBoost parameters handle the location.

WPA2 decryption requires openssl. Disabling it removes openssl as a compile-time dependency:

cmake ../ -DLIBTINS_ENABLE_WPA2=0

Disabling IEEE 802.11 support reduces the resulting library size by around 20%:

cmake ../ -DLIBTINS_ENABLE_DOT11=0

These 3 flags can be combined in a single cmake invocation. Their interaction with each other's dependencies is not fully described in the README.

LIBTINS_ENABLE_DOT11=0 also disables WPA2, but the README only credits LIBTINS_ENABLE_WPA2=0 with removing openssl

The README documents LIBTINS_ENABLE_WPA2=0 and LIBTINS_ENABLE_DOT11=0 in separate sections. LIBTINS_ENABLE_WPA2=0 is explicitly described as removing openssl as a dependency for compilation. LIBTINS_ENABLE_DOT11=0 is described as disabling IEEE 802.11 support and also disabling RadioTap and WPA2 decryption as a side effect, but the README does not say whether that flag also removes openssl.

That gap matters for a project that wants both the 20% size reduction from DOT11=0 and the removal of the openssl dependency. Because DOT11=0 disables WPA2, openssl may become unnecessary as a consequence, but the README does not confirm this. Anyone who needs both effects should check CMakeLists.txt to verify the dependency chain rather than relying on what the README leaves unstated.

17 example programs from ARP monitoring to WPS detection show the library's protocol range

17 C++ source files in the examples/ directory demonstrate distinct packet operations: arpmonitor.cpp, arpspoofing.cpp, beacon_display.cpp, defragmenter.cpp, dns_queries.cpp, dns_spoof.cpp, dns_stats.cpp, http_requests.cpp, icmp_responses.cpp, interfaces_info.cpp, portscan.cpp, route_table.cpp, stream_dump.cpp, tcp_connection_close.cpp, traceroute.cpp and wps_detect.cpp.

That range covers passive sniffing (dns_stats.cpp, stream_dump.cpp), active protocol interaction (http_requests.cpp, tcp_connection_close.cpp), route and interface inspection (route_table.cpp, interfaces_info.cpp), and 802.11-specific operations (beacon_display.cpp, wps_detect.cpp). Each example is a standalone C++ source file, not a precompiled binary, so building any of them requires a separate cmake configuration after building the main library.

The same files are available online at libtins.github.io/examples/.

libtins is C++ only, and the README leaves thread safety and packet loss behavior undocumented

libtins provides a C++ API. Teams working in C, Python, Go or any other language cannot use it. For C projects that need libpcap without an abstraction layer, libtins adds a dependency that provides no benefit.

The README does not document thread safety. Concurrent use from multiple threads is not addressed. It also does not describe what happens when the packet capture buffer overflows or when the network interface drops frames under high traffic. These details are not in the README; libtins.github.io's tutorials may cover them.

The README notes multiplatform support but does not give separate build instructions for Windows or macOS; the cmake sequence shown is for Linux. It also does not describe what packet types or protocol layers libtins handles beyond what the examples imply. Before integrating into a production pipeline, checking the API documentation at libtins.github.io against the specific protocol fields a project needs is the right step.

Editorial conclusion

libtins suits C++ developers who need to build packet analysis or crafting tools and want a multiplatform library with endianness handling built in. Teams working in any other language cannot use it. The 17 included examples cover ARP, DNS, TCP and 802.11 operations; any of them can be built directly from the examples/ directory to verify the library's scope before writing custom code. Before adopting, confirm that the cmake flags for WPA2 (LIBTINS_ENABLE_WPA2=0) and 802.11 (LIBTINS_ENABLE_DOT11=0) match the dependencies your build environment can supply, since the README does not state whether disabling DOT11 also removes the openssl requirement.

Frequently asked questions

Official sources

1. License: BSD-2-Clause
2. mfontanini/libtins on GitHub
3. Project website
4. README
5. Releases