pcaps

Documentation

Index

• Constants
• func PcapsEnabled(simple config.PcapsConfig) bool
• type Pcap
  • func NewPcap(e *trace.Event, t PcapType) (*Pcap, error)
• type PcapCache
• type PcapOption
  • func GetPcapOptions(c config.PcapsConfig) PcapOption
• type PcapType
  • func (t *PcapType) String() string
• type Pcaps
  • func New(simple config.PcapsConfig, output *os.File) (*Pcaps, error)
  • func (p *Pcaps) Destroy() error
  • func (p *Pcaps) Write(event *trace.Event, payload []byte) error

Constants

const AF_INET = 2

const AF_INET6 = 10

Functions

func PcapsEnabled

func PcapsEnabled(simple config.PcapsConfig) bool

PcapsEnabled checks if the simple config has any bool value set

Types

type Pcap

type Pcap struct {
	// contains filtered or unexported fields
}

Pcap is a representation of a pcap file

func NewPcap

func NewPcap(e *trace.Event, t PcapType) (*Pcap, error)

type PcapCache

type PcapCache struct {
	// contains filtered or unexported fields
}

PcapCache is an intermediate LRU cache in between Pcap and Pcaps

type PcapOption

type PcapOption uint32

const (
	Filtered PcapOption = 0x1
)

func GetPcapOptions

func GetPcapOptions(c config.PcapsConfig) PcapOption

type PcapType

type PcapType uint

const (
	//
	// 1 (0001): process:   1 pcap file per process (default)
	// 2 (0010): container: 1 pcap file per container
	// 4 (0011): command:   1 pcap file per command
	// 8 (1000): single:    1 single pcap file for all
	//
	// or a combination:
	//
	// 3 (0011): process + container
	// 5 (0010): process + command
	// 6 (0110): container + command
	// 7 (0111): process + container + command
	//
	None      PcapType = 0x0
	Process   PcapType = 0x1
	Container PcapType = 0x2
	Command   PcapType = 0x4
	Single    PcapType = 0x8
)

func (*PcapType) String

func (t *PcapType) String() string

type Pcaps

type Pcaps struct {
	// contains filtered or unexported fields
}

Pcaps holds all Pcap for different PcapTypes

func New

func New(simple config.PcapsConfig, output *os.File) (*Pcaps, error)

func (*Pcaps) Destroy

func (p *Pcaps) Destroy() error

Destroy destroys all opened pcap files from all supported pcap types

func (*Pcaps) Write

func (p *Pcaps) Write(event *trace.Event, payload []byte) error

Write writes a packet to all opened pcap files from all supported pcap types