Simplified Protocol Capture (SIMPCAP)

Standard packet capture architectures have no inherent support for protocol decoding. Client systems are required to handle all decoding and maintenance of protocol handling constructs in a proprietary fashion. Resultant system architectures are often not optimized and difficult to expand upon, particularly for defining and implementing new and unhandled protocols. This paper describes a new protocol decoding system called Simplified Protocol Capture (SIMPCAP). The system, developed for legacy use with LIBPCAP, constitutes an optimized high-level library architecture that automates protocol decoding and maintains protocol definition knowledge constructs globally. The SIMPCAP framework incorporates a high level API (application programming interface) for convenient and flexible access to protocol field state.