pcap

Documentation

Overview

Package pcap implements reader and writer for the pcap file format.

Index

• type Header
• type LinkType
  • func (t LinkType) String() string
• type Packet
  • func (p Packet) Clone() Packet
• type Reader
  • func NewReader(rd io.Reader) (*Reader, error)
  • func (r *Reader) ReadNext() (Packet, error)
• type Writer
  • func NewWriter(wr io.Writer, h Header) (*Writer, error)
  • func (w *Writer) WriteNext(p Packet) error

Types

type Header

type Header struct {
	// SnapLen is the snapshot length used for capturing each packet.
	// The Packet.Data length must not exceed this value.
	SnapLen int

	// LinkType specifies the type of each Packet.Data.
	LinkType LinkType
}

Header contains information from the pcap stream header.

type LinkType

type LinkType uint32

LinkType specifies the type of each Packet.Data.

const (
	EthernetLinkType LinkType = 1   // ethernet; IEEE 802.3
	RawLinkType      LinkType = 101 // raw IP; either IPv4 or IPv6
)

func (LinkType) String

func (t LinkType) String() string

type Packet

type Packet struct {
	// Timestamp is the timestamp of the packet.
	Timestamp time.Time

	// OrigLen is the original packet length.
	// Due to a smaller Header.SnapLen, the Data may be truncated.
	OrigLen int

	// Data is the captured contents of the packet,
	// where the type is determined by Header.LinkType.
	// Its length may be less than OrigLen if truncated and
	// must not exceed Header.SnapLen.
	Data []byte
}

Packet describes a captured packet.

func (Packet) Clone

func (p Packet) Clone() Packet

Clone returns a deep copy of Packet.

type Reader

type Reader struct {
	Header // must not be modified
	// contains filtered or unexported fields
}

Reader implements a streaming pcap reader.

func NewReader

func NewReader(rd io.Reader) (*Reader, error)

NewReader parses the pcap header and returns a Reader that parses each subsequent packet after the header.

The first call to Reader.ReadNext allocates a buffer proportional to Header.SnapLen, which may be arbitrarily large. It is the caller's responsibility to check whether the amount of memory needed is reasonable.

func (*Reader) ReadNext

func (r *Reader) ReadNext() (Packet, error)

ReadNext reads the next packet in the stream. The contents of Packet.Data is only valid until the next ReadNext call. Call Packet.Clone if a copy of the packet is needed. If there are no more packets in the stream, it returns io.EOF.

type Writer

type Writer struct {
	// contains filtered or unexported fields
}

Writer implements a streaming pcap writer.

func NewWriter

func NewWriter(wr io.Writer, h Header) (*Writer, error)

NewWriter writes the pcap header and returns a Writer that writes each subsequent packet after the header.

For performance, it is recommended that the io.Writer be buffered, such as provided by bufio.Writer.

func (*Writer) WriteNext

func (w *Writer) WriteNext(p Packet) error

WriteNext writes the next packet in the stream. The Packet.Data is written immediately and not retained by the call.