The hardware-grade packet broker, fully open.
Capture, filter, manipulate, mirror, load-balance and forward packets between network interfaces — driven by rules from a clean web UI. A Go control plane on top of a C data plane (libpcap · AF_XDP · DPDK). No appliance, no vendor lock-in.
Everything a commercial broker does — in code you can read.
Rule-based forwarding with the manipulation, mirroring and inspection features you'd expect from a hardware network packet broker, exposed through a web UI and a programmable C data plane.
Rule-based forwarding
Priority-ordered rules match traffic and forward it between ingress and tool ports. Enable, disable and reorder live — no restart.
Deep filtering
Match on protocol, port, IP/CIDR, MAC, TCP flags, VLAN, raw string, and full BPF expressions — with exclude rules for carve-outs.
Packet manipulation
Add, remove or rewrite VLAN tags on the fly, and truncate / slice packets to strip payloads before they reach analysis tools.
1:N mirroring / SPAN
Copy a stream to multiple tool ports at once — feed an IDS, a recorder and an analyzer from the same tap without contention.
Load balancing
Spread traffic across a group of tool ports with round-robin or 5-tuple hash — keep flows sticky while scaling out capacity.
SSL inspection chains
Route encrypted flows through a decrypt tool and re-inject the cleartext for inspection — expressed as declarative routing chains.
Deduplication
CRC32 hash-based duplicate removal drops the copies that SPAN/TAP aggregation creates, so tools only see each packet once.
24-port topology
A drag-to-connect SVG topology of all 24 ports — wire ingress to tools visually and see the live forwarding graph at a glance.
Line-rate C data plane
Pick the engine per box: portable libpcap, zero-copy AF_XDP, or DPDK — the same rules, from a laptop to embedded ARM.
Web UI + operations
Auth, rule management, topology, live CPU/mem/throughput monitoring, SNMP, syslog/CEF to your SIEM, backups and i18n — built in.
A thin control plane over a fast data plane.
The Go web UI compiles rules and pushes them to a C binary that does the packet work with libpcap, AF_XDP or DPDK. Everything runs on plain Linux or embedded ARM — no proprietary silicon required.
- ▹Pure-Go control plane, CGO-free UI
- ▹C capture → match → forward core
- ▹AF_XDP zero-copy fast path
- ▹VLAN-aware, BPF-programmable
- ▹SQLite config, no external DB
- ▹MIT licensed, self-hosted
Clone, build, broker.
The control plane is pure Go; the C data plane needs libpcap (and optionally libbpf/libxdp for AF_XDP) on a Linux box.
# 1 — get the source git clone https://github.com/kdrypr/Open-Packet-Broker cd Open-Packet-Broker # 2 — build the web/control plane (pure Go) go build ./cmd/packet-broker # 3 — build the C data plane (Linux: needs libpcap-dev) make c # libpcap + AF_XDP binaries # 4 — run — then open the UI sudo ./packet-broker # → http://localhost:8005
Own your traffic path. Star it, fork it, ship it.
MIT-licensed and self-hosted — from a homelab tap to a production span aggregator.