pcap

Documentation

Index

• Variables
• func Start(device ios.DeviceEntry) error
• type IOSPacketHeader
  • func (iph *IOSPacketHeader) ToString() string
• type NetworkInfo
  • func FindIp(device ios.DeviceEntry) (NetworkInfo, error)
• type PcaprecHdrS

Variables

var (
	// IOSPacketHeader default is -1
	Pid              = int32(-2)
	ProcName         string
	PacketHeaderSize = uint32(95)
)

Functions

func Start

func Start(device ios.DeviceEntry) error

Types

type IOSPacketHeader

type IOSPacketHeader struct {
	HdrSize        uint32 `struc:"uint32,big"`
	Version        uint8  `struc:"uint8,big"`
	PacketSize     uint32 `struc:"uint32,big"`
	Type           uint8  `struc:"uint8,big"`
	Unit           uint16 `struc:"uint16,big"`
	IO             uint8  `struc:"uint8,big"`
	ProtocolFamily uint32 `struc:"uint32,big"`
	FramePreLength uint32 `struc:"uint32,big"`
	FramePstLength uint32 `struc:"uint32,big"`
	IFName         string `struc:"[16]byte"`
	Pid            int32  `struc:"int32,little"`
	ProcName       string `struc:"[17]byte"`
	Unknown        uint32 `struc:"uint32,little"`
	Pid2           int32  `struc:"int32,little"`
	ProcName2      string `struc:"[17]byte"`
	TsSec          int    `struc:"int32,big"` /* timestamp seconds */
	TsUsec         int    `struc:"int32,big"` /* timestamp microseconds */
}

IOSPacketHeader :) ref: https://github.com/gofmt/iOSSniffer/blob/master/pkg/sniffer/sniffer.go#L44

func (*IOSPacketHeader) ToString

func (iph *IOSPacketHeader) ToString() string

type NetworkInfo

type NetworkInfo struct {
	Mac  string
	IPv4 string
	IPv6 string
}

func FindIp

func FindIp(device ios.DeviceEntry) (NetworkInfo, error)

FindIp reads pcap packets until one is found that matches the given MAC and contains an IP address. This won't work if the iOS device "automatic Wifi address" privacy feature is enabled. The MAC needs to be static.

type PcaprecHdrS

type PcaprecHdrS struct {
	TsSec   int `struc:"uint32,little"` /* timestamp seconds */
	TsUsec  int `struc:"uint32,little"` /* timestamp microseconds */
	InclLen int `struc:"uint32,little"` /* number of octets of packet saved in file */
	OrigLen int `struc:"uint32,little"` /* actual length of packet */
}

ref: https://www.wireshark.org/~martinm/mac_pcap_sample_code.c