The latest release of jNetStream (3.0a) is a pure java library that allows reading of various capture files in pcap and snoop formats. jNetStream's strength is super clean API, and very powerful editing capabilities. There is a separate module being developed, based on http://jnetpcap.com, to allow capture of packets from a live network, but that is currently still under development. There is also no protocol-header decoding as that is also being developed under the http://jnetpcap.com project.
What latest jNetStream release offers is very comprehensive file editing capabilities. Once a file is opened with jNetStream, you interact with its contents either using Iterators or Indexers. There are 3 types of iterators and indexers designed to work with either packet objects, record objects and raw records represented as a raw buffer fragments enclosing the file's record structures.
Iterators can iterate over the capture file backwards and forwards. Provide numerous "seek" methods and provide a slew of editing functions. No matter the file size.
Indexing capabilities of jNetStream impose no limit on files size and can very efficiently manipulate multi-giga byte files. Index caches are created on the fly and released as soon as the user stops accessing parts of a file. The indexer algorithm rescans portions of the file as needed to rebuild portions of the index table if it had to free up memory and release soft indexes. The indexer utilizes java's SoftReference object extensively to keep map of index to record within the file positions, extensively. It also keeps appropriately spaced hard references needed for very fast indexing of any portion of the file. The indexer also provides a slew of editing functions. Few seek operations are also provided mainly for locating certain types of records and the like. The indexer implements a normal familiar java List interface providing complete access to the file, number of records or packets and full random access.
All changes are kept in memory and are periodically flushed to physical file (configurable.) Changes can also be aborted at any time, as long as they haven't been committed to physical medium (flushed).
Files can easily be concatenated, truncated, split/sliced, appended to, records sorted, rearranged, expanded from the middle, all the while maintaining complete coherency between any instantiated iterators or indexers.
The next phase of jNetStream project, will merge with jnetpcap live capture and protocol decoding capabilities, all utilizing jNetStream API.