event

Documentation

Index

• type Packet
  • func FromPacket(ci gopacket.CaptureInfo, data []byte) (*Packet, error)
  • func ParsePacketEvent(devices map[int]dev.Device, event bpf.BpfPacketEventWithPayloadT) (*Packet, error)
  • func (p Packet) Egress() bool
  • func (p Packet) Ingress() bool
• type ProcessExec
  • func FromPacketOptions(opts pcapgo.NgPacketOptions) (ProcessExec, types.PacketContext)
  • func ParseProcessExecEvent(event bpf.BpfExecEventT) (*ProcessExec, error)
  • func (p ProcessExec) ArgsStr() string
  • func (p ProcessExec) FilenameStr() string
  • func (p ProcessExec) MatchComm(name string) bool

Types

type Packet

type Packet struct {
	Time      time.Time
	Type      packetType
	Device    dev.Device
	Pid       int
	MntNs     int
	NetNs     int
	Truncated bool
	Len       int

	Data []byte

	CgroupName string
}

func FromPacket

func FromPacket(ci gopacket.CaptureInfo, data []byte) (*Packet, error)

func ParsePacketEvent

func ParsePacketEvent(devices map[int]dev.Device, event bpf.BpfPacketEventWithPayloadT) (*Packet, error)

func (Packet) Egress

func (p Packet) Egress() bool

func (Packet) Ingress

func (p Packet) Ingress() bool

type ProcessExec

type ProcessExec struct {
	Pid int

	Filename          string
	FilenameTruncated bool

	Args          []string
	ArgsTruncated bool

	MntNs      int64
	Netns      int64
	CgroupName string
}

func FromPacketOptions

func FromPacketOptions(opts pcapgo.NgPacketOptions) (ProcessExec, types.PacketContext)

func ParseProcessExecEvent

func ParseProcessExecEvent(event bpf.BpfExecEventT) (*ProcessExec, error)

func (ProcessExec) ArgsStr

func (p ProcessExec) ArgsStr() string

func (ProcessExec) FilenameStr

func (p ProcessExec) FilenameStr() string

func (ProcessExec) MatchComm

func (p ProcessExec) MatchComm(name string) bool