pcapgo

Documentation

Overview

Package pcapgo provides some native PCAP support, not requiring C libpcap to be installed.

Index

• type Reader
  • func NewReader(r io.Reader) (*Reader, error)
  • func (r *Reader) LinkType() layers.LinkType
  • func (r *Reader) ReadPacketData() (data []byte, ci gopacket.CaptureInfo, err error)
  • func (r *Reader) String() string
• type Writer
  • func NewWriter(w io.Writer) *Writer
  • func (w *Writer) WriteFileHeader(snaplen uint32, linktype layers.LinkType) error
  • func (w *Writer) WritePacket(ci gopacket.CaptureInfo, data []byte) error

Types

type Reader

type Reader struct {
	// contains filtered or unexported fields
}

Reader wraps an underlying io.Reader to read packet data in PCAP format. See http://wiki.wireshark.org/Development/LibpcapFileFormat for information on the file format.

We currenty read v2.4 file format with nanosecond and microsecdond timestamp resolution in little-endian and big-endian encoding.

If the PCAP data is gzip compressed it is transparently uncompressed by wrapping the given io.Reader with a gzip.Reader.

func NewReader

func NewReader(r io.Reader) (*Reader, error)

NewReader returns a new reader object, for reading packet data from the given reader. The reader must be open and header data is read from it at this point. If the file format is not supported an error is returned

// Create new reader:
f, _ := os.Open("/tmp/file.pcap")
defer f.Close()
r, err := NewReader(f)
data, ci, err := r.ReadPacketData()

func (*Reader) LinkType

func (r *Reader) LinkType() layers.LinkType

LinkType returns network, as a layers.LinkType.

func (*Reader) ReadPacketData

func (r *Reader) ReadPacketData() (data []byte, ci gopacket.CaptureInfo, err error)

ReadPacketData reads next packet from file.

func (*Reader) String

func (r *Reader) String() string

Reader formater

type Writer

type Writer struct {
	// contains filtered or unexported fields
}

Writer wraps an underlying io.Writer to write packet data in PCAP format. See http://wiki.wireshark.org/Development/LibpcapFileFormat for information on the file format.

For those that care, we currently write v2.4 files with nanosecond timestamp resolution and little-endian encoding.

func NewWriter

func NewWriter(w io.Writer) *Writer

NewWriter returns a new writer object, for writing packet data out to the given writer. If this is a new empty writer (as opposed to an append), you must call WriteFileHeader before WritePacket.

// Write a new file:
f, _ := os.Create("/tmp/file.pcap")
w := pcapgo.NewWriter(f)
w.WriteFileHeader(65536, layers.LinkTypeEthernet)  // new file, must do this.
w.WritePacket(gopacket.CaptureInfo{...}, data1)
f.Close()
// Append to existing file (must have same snaplen and linktype)
f2, _ := os.OpenFile("/tmp/file.pcap", os.O_APPEND, 0700)
w2 := pcapgo.NewWriter(f2)
// no need for file header, it's already written.
w2.WritePacket(gopacket.CaptureInfo{...}, data2)
f2.Close()

func (*Writer) WriteFileHeader

func (w *Writer) WriteFileHeader(snaplen uint32, linktype layers.LinkType) error

WriteFileHeader writes a file header out to the writer. This must be called exactly once per output.

func (*Writer) WritePacket

func (w *Writer) WritePacket(ci gopacket.CaptureInfo, data []byte) error

WritePacket writes the given packet data out to the file.