Documentation
¶
Overview ¶
Package pcapgo provides some native PCAP support, not requiring C libpcap to be installed.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Reader ¶ added in v1.1.10
type Reader struct {
// contains filtered or unexported fields
}
Reader wraps an underlying io.Reader to read packet data in PCAP format. See http://wiki.wireshark.org/Development/LibpcapFileFormat for information on the file format.
We currenty read v2.4 file format with nanosecond and microsecdond timestamp resolution in little-endian and big-endian encoding.
func NewReader ¶ added in v1.1.10
NewReader returns a new reader object, for reading packet data from the given reader. The reader must be open and header data is read from it at this point. If the file format is not supported an error is returned
// Create new reader:
f, _ := os.Open("/tmp/file.pcap")
defer f.Close()
r, err := NewReader(f)
data, ci, err := r.ReadPacketData()
func (*Reader) ReadPacketData ¶ added in v1.1.10
func (r *Reader) ReadPacketData() (data []byte, ci gopacket.CaptureInfo, err error)
Read next packet from file
type Writer ¶
type Writer struct {
// contains filtered or unexported fields
}
Writer wraps an underlying io.Writer to write packet data in PCAP format. See http://wiki.wireshark.org/Development/LibpcapFileFormat for information on the file format.
For those that care, we currently write v2.4 files with nanosecond timestamp resolution and little-endian encoding.
func NewWriter ¶
NewWriter returns a new writer object, for writing packet data out to the given writer. If this is a new empty writer (as opposed to an append), you must call WriteFileHeader before WritePacket.
// Write a new file:
f, _ := os.Create("/tmp/file.pcap")
w := pcapgo.NewWriter(f)
w.WriteFileHeader(65536, layers.LinkTypeEthernet) // new file, must do this.
w.WritePacket(gopacket.CaptureInfo{...}, data1)
f.Close()
// Append to existing file (must have same snaplen and linktype)
f2, _ := os.OpenFile("/tmp/file.pcap", os.O_APPEND, 0700)
w2 := pcapgo.NewWriter(f2)
// no need for file header, it's already written.
w2.WritePacket(gopacket.CaptureInfo{...}, data2)
f2.Close()
func (*Writer) WriteFileHeader ¶
WriteFileHeader writes a file header out to the writer. This must be called exactly once per output.
func (*Writer) WritePacket ¶
func (w *Writer) WritePacket(ci gopacket.CaptureInfo, data []byte) error
WritePacket writes the given packet data out to the file.
Source Files