---
warning: DO NOT CHANGE THIS MANUALLY, THIS IS GENERATED BY https://github/duckdb/community-extensions repository, check README there
title: pcap_duckdb
excerpt: |
  DuckDB Community Extensions
  Read and analyze PCAP network capture files directly in DuckDB using a native C++ implementation based on libpcap.


extension:
  name: pcap_duckdb
  description: >
    Read and analyze PCAP network capture files directly in DuckDB using a
    native C++ implementation based on libpcap.
  version: "1.0.1"
  language: C++
  build: cmake
  license: MIT
  excluded_platforms: wasm_mvp;wasm_eh;wasm_threads;windows_amd64;windows_amd64_mingw
  maintainers:
    - siara-in
  requires_toolchains: "vcpkg"
  vcpkg_commit: 84bab45d415d22042bd0b9081aea57f362da3f35
repo:
  github: siara-in/pcap_duckdb
  ref: 6e96e3de4d9edf1836211a065dbaef574f2f1e3e
docs:
  hello_world: |
    INSTALL pcap_duckdb FROM community;
    LOAD pcap_duckdb;
    SELECT *
    FROM read_pcap('capture.pcap')
    LIMIT 10;
  extended_description: |
    The pcap_duckdb extension enables direct querying of PCAP packet capture
    files from DuckDB using SQL.
    Unlike several existing PCAP processing approaches that rely on Rust
    runtimes or external shell commands such as tcpdump/tshark, this extension
    is implemented entirely in modern C++ using libpcap via vcpkg.
    This provides:
      * Native DuckDB integration
      * No external shell command execution
      * No Rust dependency chain
      * Cross-platform builds through the DuckDB extension toolchain
      * Efficient packet-level analytics directly in SQL

extension_star_count: 1
extension_star_count_pretty: 1
extension_download_count: 747
extension_download_count_pretty: 747
image: '/images/community_extensions/social_preview/preview_community_extension_pcap_duckdb.png'
layout: community_extension_doc
---

### Installing and Loading
```sql
INSTALL {{ page.extension.name }} FROM community;
LOAD {{ page.extension.name }};
```

{% if page.docs.hello_world %}
### Example
```sql
{{ page.docs.hello_world }}```
{% endif %}

{% if page.docs.extended_description %}
### About {{ page.extension.name }}
{{ page.docs.extended_description }}
{% endif %}

### Added Functions

<div class="extension_functions_table"></div>

|   function_name   | function_type | description | comment | examples |
|-------------------|---------------|-------------|---------|----------|
| read_pcap_packets | table         | NULL        | NULL    |          |

### Overloaded Functions

<div class="extension_functions_table"></div>

This extension does not add any function overloads.

### Added Types

<div class="extension_types_table"></div>

This extension does not add any types.

### Added Settings

<div class="extension_settings_table"></div>

This extension does not add any settings.