Chapter 1

Introduction

1.1  What is IPAF?

IPAF is a framework for the efficient collection, generation and analysis of network packets, designed to be easily used by security professionals and developers to exert fine grain control over network traffic.

1.2  Why IPAF, and not libpcap, libdnet, etc?

IPAF is built on top of libpcap and libdnet, two C libraries that abstract OS functionality pertinent to collecting and generating individual network packets. While libpcap and libdnet are both extremely capable libraries, they are highly specialized libraries that do not provide functionality for packet analysis, and they are not designed to be easily embedded in high level languages, such as Python.

IPAF provides an extremely easy to use interface for manipulating network packets, and has been carefully designed to simplify embedding IPAF in many popular high level languages. It also provides an optional cooperative threading model that can greatly simplify writing high performance network tools.