pcapng

Documentation

Overview

Package pcapng implements a pcapng stream editor which edits the first Section Header Block (SHB), inserting additional meta data as comments.

Index

• Constants
• type ClusterInfo
• type ContainerInfo
• type Option
  • func NewOption(buff []byte, endian binary.ByteOrder) (opt *Option, skip uint)
  • func (o *Option) Bytes(endian binary.ByteOrder) (b []byte)
  • func (o *Option) String() string
• type StreamEditor
  • func NewStreamEditor(sink io.Writer, container *api.Target, captureFilter string, noProm bool) *StreamEditor
  • func (pe *StreamEditor) Write(b []byte) (n int, err error)

Constants

const (
	// OptEndofOpt signals the end of options.
	OptEndofOpt = uint16(0)
	// OptComment contains a comment in form of an UTF-8 string.
	OptComment = uint16(1)
	// OptSHBHardware contains the description of the hardware used to create this
	// section, in form of an UTF-8 string.
	OptSHBHardware = uint16(2)
	// OptSHBOS contains the name of the operating system used to create this
	// section, in form of an UTF-8 string.
	OptSHBOS = uint16(3)
	// OptSHBUserAppl contains the name of the application used to create this
	// section, in form of an UTF-8 string.
	OptSHBUserAppl = uint16(4)
)

Types

type ClusterInfo

type ClusterInfo struct {
	UID string `yaml:"uid,omitempty"`
}

ClusterInfo represents the cluster information to be added to the capture comments of a packet capture stream.

type ContainerInfo

type ContainerInfo struct {
	ContainerName string `yaml:"container-name"`
	ContainerType string `yaml:"container-type"`
	NodeName      string `yaml:"node-name"`
	*ClusterInfo  `yaml:"cluster,omitempty"`
	CaptureFilter string `yaml:"capture-filter,omitempty"`
	NoProm        bool   `yaml:"no-promiscuous-mode,omitempty"`
}

ContainerInfo represents the container information to be added to the capture comments of a packet capture stream.

type Option

type Option struct {
	Code  uint16 // Option Code
	Value []byte // Value
}

Option represents a pcapng option, consisting of a Code uniquely identifying the type of option, as well as its (binary) value in form of an octet string.

func NewOption

func NewOption(buff []byte, endian binary.ByteOrder) (opt *Option, skip uint)

NewOption returns a new pcapng Option read from the buffer using the given endianness, as well as the number of octets to skip over to arrive at the next option. If the last option is reached, then nil is returned, together with the amount of octets to skip past the end-of-options mark.

func (*Option) Bytes

func (o *Option) Bytes(endian binary.ByteOrder) (b []byte)

Bytes returns the octets encoding the option, using the specified endianness.

func (*Option) String

func (o *Option) String() string

String returns an option's value as a string instead of octets, assuming UTF-8 encoding.

type StreamEditor

type StreamEditor struct {
	Endian binary.ByteOrder
	// contains filtered or unexported fields
}

StreamEditor allows editing the first section header block (SHB) of a pcapng packet capture stream.

func NewStreamEditor

func NewStreamEditor(sink io.Writer, container *api.Target, captureFilter string, noProm bool) *StreamEditor

NewStreamEditor returns a new pcapng packet stream data editor, connected to the specified writer (which can be a pipe, file, et cetera).

func (*StreamEditor) Write

func (pe *StreamEditor) Write(b []byte) (n int, err error)

Write writes some octets into the pcapng stream editor which it might then edit if required before writing the (edited) stream to the associated writer sink.