tools

Documentation

Index

• func DestinationIsUnicast(p *PacketStruct) bool
• func ErrCheck(err error)
• func GetInterfaceIpv4Addr(interfaceName string, ipOverride string) (addr string, err error)
• func GetPacketInfo(packet gopacket.Packet, p *PacketStruct, minimal bool)
• func IpIsEstablished(p *PacketStruct, establishedMap map[uint64]bool, interfaceAddress string) bool
• func MiniFilter(p *PacketStruct, memoryHashmap map[uint64]bool, portScanMode bool) bool
• func PrintHeader(portScanMode bool, separatorCharacter string, minimal bool)
• func PrintPacketInfo(p *PacketStruct, memoryHashmap map[uint64]bool, ...)
• func StartCapture(inputInterface string, snapshotLen int32, promiscuous bool, ...)
• func StringToFnvUint64(s string) uint64
• type PacketStruct

Functions

func DestinationIsUnicast

func DestinationIsUnicast(p *PacketStruct) bool

Return True if the packet is Unicast (regular IP traffic)

func ErrCheck

func ErrCheck(err error)

func GetInterfaceIpv4Addr

func GetInterfaceIpv4Addr(interfaceName string, ipOverride string) (addr string, err error)

Thanks https://gist.github.com/schwarzeni/f25031a3123f895ff3785970921e962c

func GetPacketInfo

func GetPacketInfo(packet gopacket.Packet, p *PacketStruct, minimal bool)

Populate the PacketStruct

func IpIsEstablished

func IpIsEstablished(p *PacketStruct, establishedMap map[uint64]bool, interfaceAddress string) bool

Will not return outgoing packets The rest of the filtration is handled by MiniFilter

func MiniFilter

func MiniFilter(p *PacketStruct, memoryHashmap map[uint64]bool, portScanMode bool) bool

A basic packet filter, returns True if packet is to be filtered (discarded)

It begins with returning true for Mutlicast addresses since we want to ignore them
It converts the protocol, port ip string to a FNV uint64hash and adds it to the map if it does not exist
	Then returns false
If the item already exists it returns true

func PrintHeader

func PrintHeader(portScanMode bool, separatorCharacter string, minimal bool)

Print the header

func PrintPacketInfo

func PrintPacketInfo(p *PacketStruct, memoryHashmap map[uint64]bool, establishedHashmap map[uint64]bool, t int64, sep string, minimal bool, portScanMode bool, portScanWaitTimestamp int, interfaceAddress string)

Print packet information, return true if packet was printed

func StartCapture

func StartCapture(inputInterface string, snapshotLen int32, promiscuous bool, timeout time.Duration, separatorCharacter string, memoryLifetimeSeconds int, minimal bool, portScanMode bool, portScanWaitTimestamp int, interfaceAddress string)

func StringToFnvUint64

func StringToFnvUint64(s string) uint64

The function StringToFnvUint64 in the hashing.go file is designed to convert a string into a 64-bit unsigned integer using the FNV (Fowler-Noll-Vo) hash function.

Types

type PacketStruct

type PacketStruct struct {
	// contains filtered or unexported fields
}