NetworkInspector.CLI 0.4.0

NetworkInspector.CLI

Command-line entry point for capture conversion and packet export workflows. The executable name is ni.

What This Is

NetworkInspector.CLI provides two production-oriented commands:

• ni convert for frame-level format conversion (PCAP/PCAPNG/BLF workflows).
• ni export for protocol parsing and packet-level export (JSON/PBF/Text workflows).

Why It Stands Out

• One CLI for both format conversion and parsed packet export.
• Stream-friendly operation for pipelines and automation.
• Tolerant mode and progress reporting for large or imperfect captures.
• Stable exit-code contract for scripts and CI jobs.

Install

Global tool install:

dotnet tool install -g NetworkInspector.CLI

Local tool install (repository or project scope):

dotnet new tool-manifest
dotnet tool install NetworkInspector.CLI

Then run:

ni --help

Quick Start

Convert a BLF capture to PCAPNG:

ni convert capture.blf --output capture.pcapng

Export packets as compact JSON to stdout:

ni export capture.pcapng --format json

Export text output to a file:

ni export capture.pcapng --format text --output capture.txt

Commands

Run ni <command> --help for full command help.

ni convert

Frame-level conversion. No packet parsing is performed.

ni convert <input> [<input2> ...] --output <path> [options]

Common options:

• --output, -o Output path (- for stdout stream).
• --output-format, --format, -f Explicit output format spec (overrides extension).
• --profile <name> Profile name accepted for script compatibility with export.
• --settings-path <dir> Settings root accepted for script compatibility with export.
• --max-frames, -n Maximum number of frames to process.
• --split-size <MB> Split output at this size in MiB.
• --split-count <N> Split output every N frames.
• --blf-cache-size <MB> BLF cache budget in MiB.
• --progress <N> Report progress every N frames.
• --tolerant Skip malformed frames instead of aborting.

Format variants:

Examples:

# Convert BLF to PCAPNG
ni convert capture.blf --output capture.pcapng

# Split a large file into 100 MiB chunks
ni convert big.pcapng --output split/ --split-size 100

# Convert multiple sources into one output
ni convert a.blf b.blf --output merged.pcapng

# Stream converted output to stdout
ni convert capture.pcapng --output - --format pcapng

ni export

Parse frames through the protocol stack and export one record per packet.

ni export <input> [<input2> ...] [--format <fmt>] [--output <path>] [options]

Common options:

• --format, -f Export format spec.
• --output, -o Output path (omit or use - for stdout).
• --max-packets, -n Maximum packets to export.
• --profile <name> Settings profile name.
• --settings-path <dir> Base directory for settings storage.
• --blf-cache-size <MB> BLF cache budget in MiB.
• --progress <N> Report progress every N packets.
• --tolerant Skip malformed frames instead of aborting.

If --format is omitted, format is chosen from --output extension when possible. For stdout workflows, compact JSON is used by default.

Format variants:

For PBF, compression is enabled by default unless nocompress is specified.

Examples:

# Compact JSON to stdout
ni export capture.pcapng --format json

# Pretty JSON to file
ni export capture.pcapng --format json:style=pretty --output capture.json

# Human-readable protocol tree
ni export capture.pcapng --format text --output capture.txt

# Columnar PBF with compression
ni export capture.pcapng --format pbf:format=columnar,compressed --output capture.pbf

# Tolerant export with progress checkpoints
ni export unknown-input.blf --format text --output output.txt --tolerant --progress 50000

Exit Codes

Safe Usage (STRIDE)

• Spoofing: Prefer captures from trusted, attributable sources.
• Tampering: Use --tolerant for unknown files and inspect warnings.
• Repudiation: Keep original inputs and outputs together for reproducibility.
• Information disclosure: Treat JSON/Text outputs as sensitive when payload data may contain secrets.
• Denial of service: Use --max-frames, --max-packets, split options, progress checkpoints, and cancellation.
• Elevation of privilege: Run ni with least required file-system and process permissions.

Operational Notes

• Output uses UTF-8 console encoding.
• Ctrl+C triggers cooperative cancellation for long-running operations.
• Use - for stream-oriented workflows where supported.

Links

• GitHub repository
• NuGet package
• Source folder
• Issue tracker
• Root overview

License

MIT License