pcap

package module
v0.0.0-...-1c96cc0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 1, 2014 License: BSD-3-Clause Imports: 12 Imported by: 0

README 

# PCAP

This is a simple wrapper around libpcap for Go.  Originally written by Andreas
Krennmair <ak@synflood.at> and only minorly touched up by Mark Smith <mark@qq.is>.

Please see the included pcaptest.go and tcpdump.go programs for instructions on
how to use this library.

Miek Gieben <miek@miek.nl> has created a more Go-like package and replaced functionality
with standard functions from the standard library. The package has also been renamed to
pcap.

## TODO

* Could use some more documentation

Documentation

Overview

Package pcap is a wrapper around the pcap library.

Index

Constants

View Source 
const (
	TypeIP4       = 0x0800
	TypeARP       = 0x0806
	TypeWakeOnLan = 0x0842
	TypeIP6       = 0x86DD
	TypeEAPOL     = 0x888E
	TypeLLDP      = 0x88CC
	TypeHomePlug  = 0x88E1

	ARPHrdEther = 1
)

Type constants.

View Source 
const (
	TcpdumpMagic          = 0xa1b2c3d4
	KuznetsovTcpdumpMagic = 0xa1b2cd34
	FmesqiutaTcpdumpMagic = 0xa1b234cd
	NavtelTcpdumpMagic    = 0xa12b3c4d
	NsecTcpdumpMagic      = 0xa1b23c4d
)

Port from sf-pcap.c file.

View Source 
const (
	LinkTypeNull        = C.DLT_NULL
	LinkTypeRaw         = C.DLT_RAW
	LinkTypeEthernet    = C.DLT_EN10MB    // Ethernet (10Mb)
	LinkTypeLinuxCooked = C.DLT_LINUX_SLL // Linux cooked
)

LinkType constants according to pcap-linktype(7). DLT* are the data link types. They can differ per platform. See http://www.tcpdump.org/linktypes.html

View Source 
const (
	TCPFIN = 1 << iota
	TCPSYN
	TCPRST
	TCPPSH
	TCPACK
	TCPURG
	TCPECE
	TCPCWR
	TCPNS
)

TCP flags.

Variables

This section is empty.

Functions

func DatalinkValueToDescription 

func DatalinkValueToDescription(dlt int) string

DatalinkValueToDescription TODO

func DatalinkValueToName 

func DatalinkValueToName(dlt int) string

DatalinkValueToName string

func Version 

func Version() string

Version returns the current pcap library version.

Types

type ARPHdr 

type ARPHdr struct {
	Addrtype          uint16
	Protocol          uint16
	HwAddressSize     uint8
	ProtAddressSize   uint8
	Operation         uint16
	SourceHwAddress   []byte
	SourceProtAddress []byte
	DestHwAddress     []byte
	DestProtAddress   []byte
	PayloadLength     int
}

ARPHdr is a ARP packet header.

func (*ARPHdr) Len 

func (arp *ARPHdr) Len() int

Len returns the (calculated) ARP total length.

func (*ARPHdr) String 

func (arp *ARPHdr) String() (s string)

type EthernetHdr 

type EthernetHdr struct {
	Type          int // (next)protocol type
	DestMac       [6]byte
	SrcMac        [6]byte
	PayloadLength int
}

EthernetHdr is a ethernet like field.

type FileHeader 

type FileHeader struct {
	MagicNumber  uint32
	VersionMajor uint16
	VersionMinor uint16
	TimeZone     int32
	SigFigs      uint32
	SnapLen      uint32

	// NOTE: 'Network' property has been changed to `linktype`
	// Please see pcap/pcap.h header file.
	//     Network      uint32
	LinkType uint32
}

FileHeader is the parsed header of a pcap file. http://wiki.wireshark.org/Development/LibpcapFileFormat

type Fragment 

type Fragment struct {
	ProtocolID    uint8
	Length        int
	PayloadLength int
}

Fragment of any protocol. Used for non-first fragments.

type ICMPHdr 

type ICMPHdr struct {
	Type          uint8
	Code          uint8
	Checksum      uint16
	ID            uint16
	Seq           uint16
	PayloadLength int
}

ICMPHdr is the header of an ICMP packet.

func (*ICMPHdr) String 

func (icmp *ICMPHdr) String(hdr addrHdr) string

String TODO

func (*ICMPHdr) TypeString 

func (icmp *ICMPHdr) TypeString() (result string)

TypeString TODO

type ICMPv6Hdr 

type ICMPv6Hdr struct {
	Type          uint8
	Code          uint8
	Checksum      uint16
	PayloadLength int
}

ICMPv6Hdr is for ICMPv6

type IFAddress 

type IFAddress struct {
	IP      net.IP
	Netmask net.IPMask
}

IFAddress is the interface address.

type IP6Hdr 

type IP6Hdr struct {
	// http://www.networksorcery.com/enp/protocol/ipv6.htm
	Version        uint8    // 4 bits
	TrafficClass   uint8    // 8 bits
	FlowLabel      uint32   // 20 bits
	Length         uint16   // 16 bits
	NextHeader     uint8    // 8 bits, similar to Protocol in IPHdr
	HopLimit       uint8    // 8 bits
	SrcIP          [16]byte // 16 bytes
	DestIP         [16]byte // 16 bytes
	HasFragmented  bool     // Is an extended header
	FragmentOffset uint16
	PayloadLength  int
}

IP6Hdr is the header of an IPv6 packet.

func (*IP6Hdr) DestAddr 

func (ip6 *IP6Hdr) DestAddr() string

DestAddr returns the string version of the destination IP.

func (*IP6Hdr) Fragmented 

func (ip6 *IP6Hdr) Fragmented() bool

Fragmented returns if the packet was fragmented

func (*IP6Hdr) Len 

func (ip6 *IP6Hdr) Len() int

Len returns the total length of the packet 40 bytes are fixed header length

func (*IP6Hdr) SrcAddr 

func (ip6 *IP6Hdr) SrcAddr() string

SrcAddr returns the string version of the source IP.

type IPHdr 

type IPHdr struct {
	Version        uint8
	Ihl            uint8
	Tos            uint8
	Length         uint16
	ID             uint16
	Flags          uint8
	FragmentOffset uint16
	TTL            uint8
	Protocol       uint8
	Checksum       uint16
	SrcIP          [4]byte
	DestIP         [4]byte
	PayloadLength  int
}

IPHdr is the header of an IPv4 packet.

func (*IPHdr) DestAddr 

func (ip *IPHdr) DestAddr() string

DestAddr returns the string version of the destination IP.

func (*IPHdr) Fragmented 

func (ip *IPHdr) Fragmented() bool

Fragmented returns if the packet was fragmented

func (*IPHdr) Len 

func (ip *IPHdr) Len() int

Len returns the total packet length (including headers)

func (*IPHdr) SrcAddr 

func (ip *IPHdr) SrcAddr() string

SrcAddr returns the string version of the source IP.

type Interface 

type Interface struct {
	Name        string
	Description string
	Addresses   []IFAddress
}

Interface describes a single network interface on a host.

func FindAllDevs 

func FindAllDevs() ([]Interface, error)

FindAllDevs TODO

type Packet 

type Packet struct {
	DatalinkType int // DLT_* type
	// porting from 'pcap_pkthdr' struct
	Time    time.Time     // packet send/receive time
	Caplen  uint32        // bytes stored in the file (caplen <= len)
	Len     uint32        // bytes sent/received
	Data    []byte        // packet data
	Headers []interface{} // decoded headers, in order
	Payload []byte        // remaining captured non-header bytes
}

Packet is a single packet parsed from a pcap file.

func (*Packet) Decode 

func (p *Packet) Decode()

Decode decodes the headers of a Packet.

func (*Packet) String 

func (p *Packet) String() string

String prints a one-line representation of the packet header. The output is suitable for use in a tcpdump program.

type Pcap 

type Pcap struct {
	// contains filtered or unexported fields
}

Pcap wraps a pcap_t struct.

func Create 

func Create(device string) (*Pcap, error)

Create TODO

func OpenLive 

func OpenLive(device string, snaplen int32, promisc bool, timeoutMS int32) (*Pcap, error)

OpenLive opens a device and returns a handler.

func OpenOffline 

func OpenOffline(file string) (*Pcap, error)

OpenOffline provides a Pcap over a .pcap file.

func (*Pcap) Activate 

func (p *Pcap) Activate() error

Activate a packet capture handle to look at packets on the network, with the options that were set on the handle being in effect.

func (*Pcap) Close 

func (p *Pcap) Close()

Close calls pcap_close on the underlying pcap_t. 

func (p *Pcap) Datalink() int

Datalink TODO

func (*Pcap) Geterror 

func (p *Pcap) Geterror() error

Geterror converts the last pcap error to a Go error.

func (*Pcap) Getstats 

func (p *Pcap) Getstats() (*Stat, error)

Getstats TODO

func (*Pcap) Inject 

func (p *Pcap) Inject(data []byte) error

Inject TODO

func (*Pcap) Next 

func (p *Pcap) Next() (*Packet, uint64, int32)

Next wraps libpcap NextEx

func (*Pcap) NextEx 

func (p *Pcap) NextEx() (*Packet, uint64, int32)

NextEx gets the next packet on the handle.

func (*Pcap) SetBufferSize 

func (p *Pcap) SetBufferSize(sz int32) error

SetBufferSize sets buffer size (in bytes) on the activated handle. 

func (p *Pcap) SetDatalink(dlt int) error

SetDatalink TODO

func (*Pcap) SetFilter 

func (p *Pcap) SetFilter(expr string) error

SetFilter TODO

func (*Pcap) SetPromisc 

func (p *Pcap) SetPromisc(promisc bool) error

SetPromisc sets promiscuous mode on the handle. It should be called before activation.

func (*Pcap) SetReadTimeout 

func (p *Pcap) SetReadTimeout(toMs int32) error

SetReadTimeout (milliseconds) that will be used on a capture handle when it is activated.

func (*Pcap) SetSampling 

func (p *Pcap) SetSampling(rate float64)

SetSampling sets the sample rate of the handle. We perform sampling in the Go wrapper library, as efficiently as we can at that layer.

func (*Pcap) SetSnapLen 

func (p *Pcap) SetSnapLen(s int32) error

SetSnapLen TODO

type Reader 

type Reader struct {
	Header FileHeader
	// contains filtered or unexported fields
}

Reader parses pcap files.

func NewReader 

func NewReader(reader io.Reader) (*Reader, error)

NewReader reads pcap data from an io.Reader.

func (*Reader) Next 

func (r *Reader) Next() *Packet

Next returns the next packet or nil if no more packets can be read.

type Stat 

type Stat struct {
	PacketsReceived  uint32
	PacketsDropped   uint32
	PacketsIfDropped uint32
}

Stat records statistics about packets received and dropped.

type TCPHdr 

type TCPHdr struct {
	SrcPort       uint16
	DestPort      uint16
	Seq           uint32
	Ack           uint32
	DataOffset    uint8
	Flags         uint16
	Window        uint16
	Checksum      uint16
	Urgent        uint16
	PayloadLength int
}

TCPHdr is the header of a TCP packet.

func (*TCPHdr) FlagsString 

func (tcp *TCPHdr) FlagsString() string

FlagsString TODO

func (*TCPHdr) String 

func (tcp *TCPHdr) String(hdr addrHdr) string

String TODO

type UDPHdr 

type UDPHdr struct {
	SrcPort       uint16
	DestPort      uint16
	Length        uint16
	Checksum      uint16
	PayloadLength int
}

UDPHdr is the header of a UDP packet.

func (*UDPHdr) String 

func (udp *UDPHdr) String(hdr addrHdr) string

type Writer 

type Writer struct {
	// contains filtered or unexported fields
}

Writer writes a pcap file.

func NewWriter 

func NewWriter(writer io.Writer, header *FileHeader) (*Writer, error)

NewWriter creates a Writer that stores output in an io.Writer. The FileHeader is written immediately.

func (*Writer) Write 

func (w *Writer) Write(pkt *Packet) error

Writer writes a packet to the underlying writer.

Source Files

View all Source files

Directories

Path Synopsis
tools
pass command
pcaptest command
tcpdump command

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.