pcap

Documentation

Overview

Package pcap implements reading and writing the "classic" libpcap format.

Index

• type LinkType
• type Packet
• type Reader
  • func NewReader(r io.Reader) (*Reader, error)
  • func (r *Reader) Err() error
  • func (r *Reader) Next() bool
  • func (r *Reader) Packet() *Packet
• type Writer
  • func (w *Writer) Put(pkt *Packet) error

Types

type LinkType

type LinkType uint32

LinkType describes the contents of each packet in a pcap.

const (
	LinkEthernet LinkType = 1
	LinkRaw      LinkType = 101
)

Some of the more commonly used LinkTypes.

type Packet

type Packet struct {
	Timestamp time.Time
	Length    int
	Bytes     []byte
}

Packet is one raw packet and its metadata.

type Reader

type Reader struct {
	LinkType LinkType
	// contains filtered or unexported fields
}

Reader extracts packets from a pcap file.

func NewReader

func NewReader(r io.Reader) (*Reader, error)

NewReader returns a new Reader that decodes pcap data from r.

func (*Reader) Err

func (r *Reader) Err() error

Err returns the first non-EOF error encountered by the Reader.

func (*Reader) Next

func (r *Reader) Next() bool

Next advances the Reader to the next packet in the input, which will then be available through the Packet method. It returns false when the Reader stops, either by reaching the end of the input or an error. After Next returns false, the Err method will return any error that occured while reading, except that if it was io.EOF, Err will return nil.

func (*Reader) Packet

func (r *Reader) Packet() *Packet

Packet returns the packet read by the last call to Next.

type Writer

type Writer struct {
	Writer    io.Writer
	LinkType  LinkType
	SnapLen   uint32
	ByteOrder binary.ByteOrder // defaults to binary.LittleEndian
	// contains filtered or unexported fields
}

Writer serializes Packets to an io.Writer.

func (*Writer) Put

func (w *Writer) Put(pkt *Packet) error

Put serializes pkt to w.Writer.