filter

Documentation

Overview

Package filter exposes interfaces and implementations for packet capture

Package filter exposes interfaces and implementations for packet capture

Index

• type AFPacketInfo
• type AFPacketSource
  • func NewAFPacketSource(size int, opts ...interface{}) (*AFPacketSource, error)
  • func (p *AFPacketSource) Close()
  • func (p *AFPacketSource) LayerType() gopacket.LayerType
  • func (p *AFPacketSource) SetBPF(filter []bpf.RawInstruction) error
  • func (p *AFPacketSource) SetEbpf(filter *manager.Probe) error
  • func (p *AFPacketSource) VisitPackets(exit <-chan struct{}, visit AFPacketVisitor) error
• type AFPacketVisitor
• type OptSnapLen
• type PacketInfo
• type PacketSource

Types

type AFPacketInfo

type AFPacketInfo struct {
	// PktType corresponds to sll_pkttype in the
	// sockaddr_ll struct; see packet(7)
	// https://man7.org/linux/man-pages/man7/packet.7.html
	PktType uint8
}

AFPacketInfo holds information about a packet

type AFPacketSource

type AFPacketSource struct {
	*afpacket.TPacket
	// contains filtered or unexported fields
}

AFPacketSource provides a RAW_SOCKET attached to an eBPF SOCKET_FILTER

func NewAFPacketSource

func NewAFPacketSource(size int, opts ...interface{}) (*AFPacketSource, error)

NewAFPacketSource creates an AFPacketSource using the provided BPF filter

func (*AFPacketSource) Close

func (p *AFPacketSource) Close()

Close stops packet reading

func (*AFPacketSource) LayerType

func (p *AFPacketSource) LayerType() gopacket.LayerType

LayerType is the gopacket.LayerType for this source

func (*AFPacketSource) SetBPF

func (p *AFPacketSource) SetBPF(filter []bpf.RawInstruction) error

SetBPF attaches a (classic) BPF socket filter to the AFPacketSource

func (*AFPacketSource) SetEbpf

func (p *AFPacketSource) SetEbpf(filter *manager.Probe) error

SetEbpf attaches an eBPF socket filter to the AFPacketSource

func (*AFPacketSource) VisitPackets

func (p *AFPacketSource) VisitPackets(exit <-chan struct{}, visit AFPacketVisitor) error

VisitPackets starts reading packets from the source

type AFPacketVisitor

type AFPacketVisitor = func(data []byte, info PacketInfo, t time.Time) error

AFPacketVisitor is the callback that AFPacketSource will trigger for packets The data buffer is reused between calls, so be careful

type OptSnapLen

type OptSnapLen int

OptSnapLen specifies the maximum length of the packet to read

Defaults to 4096 bytes

type PacketInfo

type PacketInfo interface{}

PacketInfo holds OS dependent packet information about a packet

type PacketSource

type PacketSource interface {
	// VisitPackets reads all new raw packets that are available, invoking the given callback for each packet.
	// If no packet is available, VisitPacket returns immediately.
	// The format of the packet is dependent on the implementation of PacketSource -- i.e. it may be an ethernet frame, or a IP frame.
	// The data buffer is reused between invocations of VisitPacket and thus should not be pointed to.
	// If the cancel channel is closed, VisitPackets will stop reading.
	VisitPackets(cancel <-chan struct{}, visitor func(data []byte, info PacketInfo, timestamp time.Time) error) error

	// LayerType returns the type of packet this source reads
	LayerType() gopacket.LayerType

	// Close closes the packet source
	Close()
}

PacketSource reads raw packet data