pcap

Documentation

Overview

Package pcap implements writing packet data to pcap files.

Index

• type LinkType
• type Writer
  • func NewWriter(w io.Writer) *Writer
  • func (w *Writer) WriteFileHeader(snaplen uint32, linktype LinkType) error
  • func (w *Writer) WritePacket(ci gopacket.CaptureInfo, data []byte) error

Types

type LinkType

type LinkType uint32

LinkType is the link type for the pcap file.

const (
	LinkTypeEthernet LinkType = 1
	LinkTypeRaw      LinkType = 101
)

LinkType values.

type Writer

type Writer struct {
	// contains filtered or unexported fields
}

Writer wraps an underlying io.Writer to write packet data in PCAP format. See http://wiki.wireshark.org/Development/LibpcapFileFormat for information on the file format.

For those that care, we currently write v2.4 files with nanosecond or microsecond timestamp resolution and little-endian encoding.

func NewWriter

func NewWriter(w io.Writer) *Writer

NewWriter returns a new writer object.

If this is a new empty writer (as opposed to an append), you must call WriteFileHeader before WritePacket. Packet timestamps are written with nanosecond precision.

func (*Writer) WriteFileHeader

func (w *Writer) WriteFileHeader(snaplen uint32, linktype LinkType) error

WriteFileHeader writes a file header out to the writer. This must be called exactly once per output.

func (*Writer) WritePacket

func (w *Writer) WritePacket(ci gopacket.CaptureInfo, data []byte) error

WritePacket writes the given packet data out to the file.