pktutil

Documentation

Overview

Package pktutil provides utilities for decoding network packets.

Index

• type TCPFlag
• type TransportPacket
  • func DecodeTransportPacket(pkt []byte, firstLayer gopacket.LayerType) (*TransportPacket, error)
  • func (p TransportPacket) DestinedFor(addr net.Addr) bool
  • func (p TransportPacket) DstIP() net.IP
  • func (p TransportPacket) ExpectedACK() uint32
  • func (p TransportPacket) Flags() []TCPFlag
  • func (p TransportPacket) HasAllFlags(flags ...TCPFlag) bool
  • func (p TransportPacket) HasAnyFlags(flags ...TCPFlag) bool
  • func (p TransportPacket) PartOf(conn net.Conn) bool
  • func (p TransportPacket) Pprint() string
  • func (p TransportPacket) SrcIP() net.IP

Types

type TCPFlag

type TCPFlag string

TCPFlag is a flag on a TCP packet.

const (
	SYN TCPFlag = "SYN"
	FIN TCPFlag = "FIN"
	ACK TCPFlag = "ACK"
	URG TCPFlag = "URG"
	PSH TCPFlag = "PSH"
	RST TCPFlag = "RST"
	ECE TCPFlag = "ECE"
	CWR TCPFlag = "CWR"
	NS  TCPFlag = "NS"
)

All TCP flags.

type TransportPacket

type TransportPacket struct {
	IPv4Layer *layers.IPv4
	IPv6Layer *layers.IPv6
	TCPLayer  *layers.TCP
	UDPLayer  *layers.UDP
	Payload   gopacket.Payload

	// Timestamp is available for convenience. It will not be set for decoded packets, but users of
	// the TransportPacket type can attach their own timestamps as needed.
	Timestamp time.Time
}

TransportPacket is a decoded packet at the transport layer.

func DecodeTransportPacket

func DecodeTransportPacket(pkt []byte, firstLayer gopacket.LayerType) (*TransportPacket, error)

DecodeTransportPacket decodes a transport packet. The timestamp field will not be set on the returned packet.

The firstLayer parameter tells the decoder how to interpret the packet. If this packet is a captured packet from a utility in the probednet package, it is likely a link-layer packet. Thus firstLayer should be either layers.LayerTypeEthernet or layers.LayerTypeLoopback.

Note that on Linux, loopback packets are encoded in ethernet frames, so even if the packet was sent through the loopback interface, you would need to specify firstLayer as layers.LayerTypeEthernet.

func (TransportPacket) DestinedFor

func (p TransportPacket) DestinedFor(addr net.Addr) bool

DestinedFor returns true if this packet is destined for addr.

func (TransportPacket) DstIP

func (p TransportPacket) DstIP() net.IP

DstIP provides the packet's destination IP address. Returns nil if no IP layer has been decoded.

func (TransportPacket) ExpectedACK

func (p TransportPacket) ExpectedACK() uint32

ExpectedACK for this packet. Returns 0 if this is not a TCP packet.

func (TransportPacket) Flags

func (p TransportPacket) Flags() []TCPFlag

Flags returns the set of TCP flags on this packet. The order of the flags in the slice will be consistent across packets.

func (TransportPacket) HasAllFlags

func (p TransportPacket) HasAllFlags(flags ...TCPFlag) bool

HasAllFlags reports whether the packet has all of the input flags.

func (TransportPacket) HasAnyFlags

func (p TransportPacket) HasAnyFlags(flags ...TCPFlag) bool

HasAnyFlags reports whether the packet has any of the input flags.

func (TransportPacket) PartOf

func (p TransportPacket) PartOf(conn net.Conn) bool

PartOf returns true iff this is a packet routed between conn.LocalAddr() and conn.RemoteAddr().

func (TransportPacket) Pprint

func (p TransportPacket) Pprint() string

Pprint (pretty print) formats the packet nicely for logging and debugging. If a layer is missing, it will not appear in the output.

func (TransportPacket) SrcIP

func (p TransportPacket) SrcIP() net.IP

SrcIP provides the packet's source IP address. Returns nil if no IP layer has been decoded.