collector

Documentation

Index

• func DumpProto(pb proto.Message)
• func IsPcap(file string) (bool, error)
• type AtomicPcapGoWriter
  • func NewAtomicPcapGoWriter(w *pcapgo.Writer) *AtomicPcapGoWriter
  • func (a *AtomicPcapGoWriter) WritePacket(ci gopacket.CaptureInfo, data []byte) error
• type BatchInfo
• type Collector
  • func New(config Config) *Collector
  • func (c *Collector) CollectBPF(path string, bpf string)
  • func (c *Collector) CollectLive(i string, bpf string)
  • func (c *Collector) CollectPcap(path string)
  • func (c *Collector) CollectPcapNG(path string)
  • func (c *Collector) Init()
  • func (c *Collector) InitBatching(maxSize int, bpf string, in string) ([]BatchInfo, *pcap.Handle)
  • func (c *Collector) Stats()
• type Config

Functions

func DumpProto

func DumpProto(pb proto.Message)

func IsPcap

func IsPcap(file string) (bool, error)

IsPcap checks wheter a file is a PCAP file

Types

type AtomicPcapGoWriter

type AtomicPcapGoWriter struct {
	sync.Mutex
	// contains filtered or unexported fields
}

AtomicPcapGoWriter is a symchronized PCAP writer that counts the number of packets written

func NewAtomicPcapGoWriter

func NewAtomicPcapGoWriter(w *pcapgo.Writer) *AtomicPcapGoWriter

NewAtomicPcapGoWriter takes a pcapgo.Writer and returns an atomic version

func (*AtomicPcapGoWriter) WritePacket

func (a *AtomicPcapGoWriter) WritePacket(ci gopacket.CaptureInfo, data []byte) error

WritePacket writes a packet into the writer

type BatchInfo

type BatchInfo struct {
	Type types.Type
	Chan <-chan []byte
}

BatchInfo contains information about a Batch source

type Collector

type Collector struct {
	// contains filtered or unexported fields
}

Collector provides an interface to collect data from PCAP or a network interface

func New

func New(config Config) *Collector

New returns a new Collector instance

func (*Collector) CollectBPF

func (c *Collector) CollectBPF(path string, bpf string)

CollectBPF open the named PCAP file and sets the specified BPF filter

func (*Collector) CollectLive

func (c *Collector) CollectLive(i string, bpf string)

CollectLive starts collection of data from the given interface optionally a BPF can be supplied this is the linux version that uses the pure go version from pcapgo to fetch packets live

func (*Collector) CollectPcap

func (c *Collector) CollectPcap(path string)

CollectPcap implements parallel decoding of incoming packets

func (*Collector) CollectPcapNG

func (c *Collector) CollectPcapNG(path string)

CollectPcapNG implements parallel decoding of incoming packets

func (*Collector) Init

func (c *Collector) Init()

Init sets up the collector and starts the configured number of workers must be called prior to usage of the collector instance

func (*Collector) InitBatching

func (c *Collector) InitBatching(maxSize int, bpf string, in string) ([]BatchInfo, *pcap.Handle)

InitBatching initializes batching mode and returns an array of Batchinfos and the pcap handle closing the handle must be done by the caller

func (*Collector) Stats

func (c *Collector) Stats()

Stats prints collector statistics

type Config

type Config struct {
	Live                bool
	WriteUnknownPackets bool
	Workers             int
	NumWorkers          int
	PacketBufferSize    int
	SnapLen             int
	Promisc             bool
	EncoderConfig       encoder.Config
}

Config contains configuration parameters for the Collector instance