nuclearcat · Oct 22, 2026 · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -31,5 +31,7 @@ jobs:
       run: python3 -B pkg/test-release-metadata.py
     - name: Build
       run: cargo build --locked --verbose
+    - name: Test offline BMP decoder
+      run: cargo test --locked -p netom-bmpdump --verbose
     - name: Run tests, including mrtgen MRT corpus
       run: cargo test --locked --lib --verbose
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -26,14 +26,15 @@ name = "netom-cli"
 path = "src/bin/netom-cli/main.rs"
 
 [workspace.package]
-version = "0.6.0"
+version = "0.6.1"
 edition = "2021"
 rust-version = "1.88"
 authors = ["NLnet Labs <routing-team@nlnetlabs.nl>", "FastNetMon Inc <support@fastnetmon.com>"]
 
 
 [workspace]
-#members = []
+members = ["tools/bmpdump"]
+default-members = [".", "tools/bmpdump"]
 
 [workspace.dependencies]
 routecore          = { git = "https://github.com/FastNetMon/routecore.git", features = ["bgp", "bmp", "serde", "fsm", "mrt"] }
@@ -165,15 +166,18 @@ priority = "optional"
 assets = [
     ["target/release/netom", "usr/bin/", "755"],
     ["target/release/netom-cli", "usr/bin/", "755"],
+    ["target/release/netom-bmpdump", "usr/bin/", "755"],
     ["README.md", "usr/share/doc/netom/", "644"],
     ["NOTICE.md", "usr/share/doc/netom/", "644"],
     ["docs/bmp-tcp-in.md", "usr/share/doc/netom/", "644"],
+    ["docs/bmpdump.md", "usr/share/doc/netom/", "644"],
     ["docs/clickhouse.md", "usr/share/doc/netom/", "644"],
     ["docs/clickhouse/schema.sql", "usr/share/doc/netom/clickhouse/schema.sql", "644"],
     ["docs/clickhouse/example.conf", "usr/share/doc/netom/clickhouse/example.conf", "644"],
     ["docs/clickhouse/schema.sql", "usr/share/netom/clickhouse/schema.sql", "644"],
     ["doc/netom.1", "usr/share/man/man1/netom.1", "644"],
     ["doc/netom-cli.1", "usr/share/man/man1/netom-cli.1", "644"],
+    ["doc/netom-bmpdump.1", "usr/share/man/man1/netom-bmpdump.1", "644"],
     ["etc/netom.conf", "etc/netom/netom.conf.example", "644"],
 
     ["etc/examples/filters.roto.example", "usr/share/netom/examples/filters.roto.example", "644"],

diff --git a/Changelog.md b/Changelog.md
@@ -27,6 +27,11 @@ Released yyyy-mm-dd.
 
 ### New
 
+* Added `netom-bmpdump`, an offline BMP/BGP/EVPN decoder for PCAP and PCAPNG
+  captures, with TCP reassembly, readable/colorized output, filters, and
+  JSON export. The standalone workspace package is included in the
+  DEB/RPM packages and runtime images.
+
 * `netom-cli show ip bgp detail` (and `show ipv6 bgp detail`) prints every
   attribute of each path: peer and AS, how it was learned (ingress, BMP,
   pre/post-policy, ADD-PATH path id), status and RPKI, origin, AS path,

diff --git a/README.md b/README.md
@@ -57,6 +57,20 @@ see [Releases](docs/releases.md).
 For issues with this fork, use the FastNetMon repository and support channels.
 Upstream NLnet Labs community resources may not apply to this fork.
 
+## Offline BMP capture decoder
+
+The additional `netom-bmpdump` tool decodes BMP/BGP/EVPN from PCAP and PCAPNG
+files, with TCP reassembly, readable/colorized output, filters, and JSON.
+It runs without the daemon, Python, TShark, or root privileges.
+
+```sh
+cargo build --locked --release -p netom-bmpdump
+./target/release/netom-bmpdump -r capture.pcapng --evpn -v
+```
+
+It is included in the Netom DEB/RPM packages and runtime images. See the
+[decoder guide](docs/bmpdump.md) for usage and limitations.
+
 ## GOALS
 
 #### Modularity

diff --git a/TESTING.md b/TESTING.md
@@ -80,3 +80,19 @@ validity states.
 
 The `e2e-flowspec` GitHub workflow runs both scripts on demand
 (workflow_dispatch).
+
+## Offline BMP decoder
+
+```sh
+cargo test --locked -p netom-bmpdump
+cargo clippy --locked -p netom-bmpdump --all-targets -- -D warnings
+```
+
+Tests construct their own packet fixtures and do not require a running Netom
+daemon. For the optional `netom-bmp-evpn.pcapng` reference-capture regression
+(the capture is not distributed in this repository), set:
+
+```sh
+NETOM_BMPDUMP_TEST_CAPTURE=/path/to/netom-bmp-evpn.pcapng \
+  cargo test --locked -p netom-bmpdump supplied_capture_regression
+```
diff --git a/doc/netom-bmpdump.1 b/doc/netom-bmpdump.1
@@ -0,0 +1,103 @@
+.TH "netom\-bmpdump" "1" "FastNetMon Inc"
+.SH NAME
+netom\-bmpdump \- offline BMP, BGP and EVPN capture decoder
+.SH SYNOPSIS
+.B netom\-bmpdump
+.BI \-r " FILE"
+[options]
+.SH DESCRIPTION
+Reads PCAP or PCAPNG captures, reassembles TCP streams, and displays BMP
+messages and their BGP/EVPN contents. It runs without a Netom daemon,
+TShark, Python, or root privileges.
+.PP
+Each output record represents one BMP message. Multiple messages in one
+packet are separated and split messages are reassembled.
+.SH OPTIONS
+.TP
+.BI \-r " FILE" "\fR, \fB\-\-read " FILE
+Read a capture. Use a dash for standard input.
+.TP
+.BI \-p " PORT" "\fR, \fB\-\-port " PORT
+Select a BMP TCP port. Repeat to select multiple ports.
+Replaces the default ports 11019 and 1790.
+.TP
+.BI \-c " COUNT" "\fR, \fB\-\-count " COUNT
+Stop after this many matching BMP messages.
+.TP
+.B \-v\fR, \fB\-\-verbose
+Print readable message blocks with every route.
+Use \fB\-vv\fR to also print the complete decoded JSON.
+.TP
+.B \-n
+Numeric addresses, which are always enabled.
+.TP
+.B \-j\fR, \fB\-\-json
+Print newline-delimited JSON. JSON output never contains ANSI colors.
+.TP
+.B \-\-summary
+Only print aggregate counts. Combine with \fB\-\-json\fR for a JSON summary.
+.TP
+.BI \-\-color " auto|always|never"
+Control ANSI colors. The default, auto, requires a recognized color terminal
+and honors NO_COLOR. Always explicitly overrides automatic detection.
+.TP
+.BI \-\-router " ADDRESS"
+Filter by the BMP exporter's source IP address.
+.TP
+.BI \-\-peer " ADDRESS"
+Filter by the monitored BGP peer's IP address.
+.TP
+.BI \-\-type " TYPE"
+Filter by route-monitoring, statistics, peer-down, peer-up, initiation,
+termination, or route-mirroring.
+.TP
+.B \-\-evpn
+Only messages containing EVPN NLRI.
+.TP
+.BI \-\-route-type " 1|2|3|4|5"
+Only messages containing this EVPN route type.
+.TP
+.B \-\-add-path
+Force ADD-PATH for supported families when Peer Up negotiation is missing.
+Use only when those families are known to use ADD-PATH.
+.TP
+.B \-h\fR, \fB\-\-help
+Show command help.
+.TP
+.B \-V\fR, \fB\-\-version
+Show the Netom release version.
+.SH EXAMPLES
+.nf
+netom-bmpdump -r capture.pcapng --evpn -v
+netom-bmpdump -r capture.pcapng --route-type 5 -j
+netom-bmpdump -r capture.pcapng --summary
+netom-bmpdump -r capture.pcapng -v --color always | less -R
+.fi
+.SH EXIT STATUS
+0: clean completion.
+.br
+2: read/decode errors or diagnostics; partial output may still be useful.
+.br
+130: interrupted.
+.SH LIMITATIONS
+IP fragment reassembly, encrypted transport, IPv6 jumbograms, and extended
+BGP OPEN optional-parameter encoding are not implemented. Checksums are not
+validated. Missing TCP data is reported. Unknown protocol fields are
+retained as raw hexadecimal data in JSON.
+.PP
+Capture timestamps use UTC and identify the packet completing reassembly.
+Filters select whole messages, including other routes in a matching message.
+.SH ENVIRONMENT
+.TP
+.B NO_COLOR
+Disable automatic coloring.
+.TP
+.B TERM
+Used for terminal color detection.
+.TP
+.B COLUMNS
+Override the output width, bounded to 60 through 120 columns.
+.SH SEE ALSO
+.BR netom (1),
+.BR netom-cli (1),
+.BR tcpdump (8)