filter

Documentation

Overview

Package filter exposes interfaces and implementations for packet capture

Package filter exposes interfaces and implementations for packet capture

Index

• type AFPacketInfo
• type AFPacketSource
  • func NewAFPacketSource(size int, opts ...interface{}) (*AFPacketSource, error)
  • func (p *AFPacketSource) Close()
  • func (p *AFPacketSource) LayerType() gopacket.LayerType
  • func (p *AFPacketSource) SetBPF(filter []bpf.RawInstruction) error
  • func (p *AFPacketSource) SetEbpf(filter *manager.Probe) error
  • func (p *AFPacketSource) VisitPackets(exit <-chan struct{}, ...) error
• type OptSnapLen
• type PacketInfo
• type PacketSource

Types

type AFPacketInfo

type AFPacketInfo struct {
	// PktType corresponds to sll_pkttype in the
	// sockaddr_ll struct; see packet(7)
	// https://man7.org/linux/man-pages/man7/packet.7.html
	PktType uint8
}

AFPacketInfo holds information about a packet

type AFPacketSource

type AFPacketSource struct {
	*afpacket.TPacket
	// contains filtered or unexported fields
}

AFPacketSource provides a RAW_SOCKET attached to an eBPF SOCKET_FILTER

func NewAFPacketSource

func NewAFPacketSource(size int, opts ...interface{}) (*AFPacketSource, error)

NewAFPacketSource creates an AFPacketSource using the provided BPF filter

func (*AFPacketSource) Close

func (p *AFPacketSource) Close()

Close stops packet reading

func (*AFPacketSource) LayerType

func (p *AFPacketSource) LayerType() gopacket.LayerType

LayerType is the gopacket.LayerType for this source

func (*AFPacketSource) SetBPF

func (p *AFPacketSource) SetBPF(filter []bpf.RawInstruction) error

SetBPF attaches a (classic) BPF socket filter to the AFPacketSource

func (*AFPacketSource) SetEbpf

func (p *AFPacketSource) SetEbpf(filter *manager.Probe) error

SetEbpf attaches an eBPF socket filter to the AFPacketSource

func (*AFPacketSource) VisitPackets

func (p *AFPacketSource) VisitPackets(exit <-chan struct{}, visit func(data []byte, info PacketInfo, t time.Time) error) error

VisitPackets starts reading packets from the source

type OptSnapLen

type OptSnapLen int

OptSnapLen specifies the maximum length of the packet to read

Defaults to 4096 bytes

type PacketInfo

type PacketInfo interface{}

PacketInfo holds OS dependent packet information about a packet

type PacketSource

type PacketSource interface {
	// VisitPackets reads all new raw packets that are available, invoking the given callback for each packet.
	// If no packet is available, VisitPacket returns immediately.
	// The format of the packet is dependent on the implementation of PacketSource -- i.e. it may be an ethernet frame, or a IP frame.
	// The data buffer is reused between invocations of VisitPacket and thus should not be pointed to.
	// If the cancel channel is closed, VisitPackets will stop reading.
	VisitPackets(cancel <-chan struct{}, visitor func(data []byte, info PacketInfo, timestamp time.Time) error) error

	// LayerType returns the type of packet this source reads
	LayerType() gopacket.LayerType

	// Close closes the packet source
	Close()
}

PacketSource reads raw packet data