pcapng

README

PcapNG

This library provides packet reading capabilities of files in pcang format.

// Create new reader:
f, _ := os.Open("file.pcapng")
defer f.Close()
r, err := NewReader(f)
data, ci, err := r.ReadPacketData()

Documentation

Overview

Package pcapng provides support for reading packets from PCAP-NG file. See https://github.com/pcapng/pcapng for information of the file format.

Made to be compatible with https://github.com/google/gopacket/pcapgo

Index

• Variables
• type Reader
  • func NewReader(r io.Reader) (ret *Reader, err error)
  • func (r *Reader) LinkType() layers.LinkType
  • func (r *Reader) ReadPacketData() (data []byte, ci gopacket.CaptureInfo, err error)

Variables

var ErrPerPacketEncap = errors.New("doesn't support per-packet encapsulations")

ErrPerPacketEncap is the error returned by ReadPacketData when packets have different link types (link type of current packet is different from previous packets)

Types

type Reader

type Reader struct {
	// contains filtered or unexported fields
}

Reader wraps io.Reader to read packet data in PCAPNG format. If the PCAPNG data is gzip compressed it is transparently uncompressed by wrapping the given io.Reader with a gzip.Reader.

func NewReader

func NewReader(r io.Reader) (ret *Reader, err error)

NewReader returns a new reader object, for reading packet data from the given reader. The reader must be open and must contain as first block - Section Header Block and Interface Description Block before any packet block. If the file format is not supported an error is returned

// Create new reader:
f, _ := os.Open("file.pcapng")
defer f.Close()
r, err := NewReader(f)
data, ci, err := r.ReadPacketData()

func (*Reader) LinkType

func (r *Reader) LinkType() layers.LinkType

LinkType return link type of first Interface Description block

func (*Reader) ReadPacketData

func (r *Reader) ReadPacketData() (data []byte, ci gopacket.CaptureInfo, err error)

ReadPacketData read until get packet block (any of EPB, SPB or PB). If get SHB or IDB, process it and continue to read. Skip any other block types. If packets have different link type return error ErrPerPacketEncap.