tools

Documentation

Index

• func ErrCheck(err error)
• func GetInterfaceIpv4Addr(interfaceName string, ipOverride string) (addr string, err error)
• func GetPacketInfo(packet gopacket.Packet, p *PacketStruct, minimal bool)
• func IpBlacklistFilter(p *PacketStruct, blacklistMap map[string]bool, interfaceAddress string) bool
• func MiniFilter(p *PacketStruct, memoryHashmap map[string]bool) bool
• func PrintHeader(portScanMode bool, separatorCharacter string, minimal bool)
• func PrintPacketInfo(p *PacketStruct, memoryHashmap map[string]bool, ...)
• func StartCapture(inputInterface string, snapshotLen int32, promiscuous bool, ...)
• type PacketStruct

Functions

func ErrCheck

func ErrCheck(err error)

func GetInterfaceIpv4Addr

func GetInterfaceIpv4Addr(interfaceName string, ipOverride string) (addr string, err error)

Thanks https://gist.github.com/schwarzeni/f25031a3123f895ff3785970921e962c

func GetPacketInfo

func GetPacketInfo(packet gopacket.Packet, p *PacketStruct, minimal bool)

Populate the PacketStruct

func IpBlacklistFilter

func IpBlacklistFilter(p *PacketStruct, blacklistMap map[string]bool, interfaceAddress string) bool

Create a blacklist map of outgoing IP's This is to prevent printing established traffic

For every packet add destination IP to blacklist (unless it's the listening device's IP)

This prevents the response from the remote server to get logged.
If the source IP (remote server) matches an IP that has already been a destination then dont log it.

This is to be able to only show connection attempts made from the outside

func MiniFilter

func MiniFilter(p *PacketStruct, memoryHashmap map[string]bool) bool

A basic version of the ignore filter stores all rows for x minutes so duplicates do not get printed

Returns true if srcIpPort and dstIpPort has been seen before

func PrintHeader

func PrintHeader(portScanMode bool, separatorCharacter string, minimal bool)

Print the header

func PrintPacketInfo

func PrintPacketInfo(p *PacketStruct, memoryHashmap map[string]bool, blacklistHashmap map[string]bool, t int64, sep string, minimal bool, portScanMode bool, interfaceAddress string)

Print packet information, return true if packet was printed

func StartCapture

func StartCapture(inputInterface string, snapshotLen int32, promiscuous bool, timeout time.Duration, separatorCharacter string, memoryLifetimeSeconds int, minimal bool, portScanMode bool, interfaceAddress string)

Types

type PacketStruct

type PacketStruct struct {
	// contains filtered or unexported fields
}