httpcap

README

httpcap

Parse and display http traffic from network device or pcap file. This is a go version of origin pcap-parser, thanks to gopacket project, this tool has simpler code base and is more efficient.

Dependency

httpcap uses libpcap, a system-independent interface for user-level packet capture,Before use httpcap, you must first install libpcap

for ubuntu/debian:

sudo apt install libpcap-dev

for centos/redhat/fedora:

sudo yum install libpcap-devel

Installation

$ go install github.com/uole/httpcap@latest

Usage

Usage of httpcap:
  -assembly_debug_log
        If true, the github.com/google/gopacket/reassembly library will log verbose debugging information (at least one line per packet)
  -assembly_memuse_log
        If true, the github.com/google/gopacket/reassembly library will log information regarding its memory use every once in a while.
  -f string
        packet filter in libpcap filter syntax
  -host string
        filter http request host, using wildcard match(*)
  -i string
        name of interface (default "eth0")
  -ip string
        filter source or target ip
  -p int
        filter source or target port
  -l    list of interfaces and exit
  -v    display version info and exit

Example

list interfaces

root@localhost:~# httpcap -l
Name                                 Description
veth4917cfa
veth5fba3eb
veth93a23daf
vethf578bde
eth0

http capture

$ httpcap -i eth0 

Documentation

Index

• type App
  • func NewApp(filter *Filter) *App
  • func (app *App) Handle(req *http.Request, res *http.Response)
  • func (app *App) Run(ctx context.Context, iface string) (err error)
• type AssemblerContext
  • func (ctx *AssemblerContext) GetCaptureInfo() gopacket.CaptureInfo
• type Buffer
  • func (r *Buffer) Close() (err error)
  • func (r *Buffer) Read(p []byte) (n int, err error)
  • func (r *Buffer) Reader() *bufio.Reader
  • func (r *Buffer) Reset()
• type Capture
  • func NewCapture(iface string, snaplen int, filter *Filter) *Capture
  • func (cap *Capture) Start(ctx context.Context) (err error)
  • func (cap *Capture) Stop() (err error)
  • func (cap *Capture) WithHandle(f HandleFunc) *Capture
• type Filter
  • func (filter *Filter) Match(host string) bool
• type HandleFunc
• type State
• type Stream
  • func (stream *Stream) Accept(tcp *layers.TCP, ci gopacket.CaptureInfo, dir reassembly.TCPFlowDirection, ...) bool
  • func (stream *Stream) NextRequest() (req *httppkg.Request, res *httppkg.Response, err error)
  • func (stream *Stream) ReassembledSG(sg reassembly.ScatterGather, ac reassembly.AssemblerContext)
  • func (stream *Stream) ReassemblyComplete(ac reassembly.AssemblerContext) bool
• type StreamFactory
  • func NewFactory(ctx context.Context, f HandleFunc) *StreamFactory
  • func (factory *StreamFactory) New(netFlow, tcpFlow gopacket.Flow, tcp *layers.TCP, ...) reassembly.Stream
  • func (factory *StreamFactory) Wait()

Types

type App

type App struct {
	// contains filtered or unexported fields
}

func NewApp

func NewApp(filter *Filter) *App

func (*App) Handle

func (app *App) Handle(req *http.Request, res *http.Response)

func (*App) Run

func (app *App) Run(ctx context.Context, iface string) (err error)

type AssemblerContext

type AssemblerContext struct {
	// contains filtered or unexported fields
}

func (*AssemblerContext) GetCaptureInfo

func (ctx *AssemblerContext) GetCaptureInfo() gopacket.CaptureInfo

type Buffer

type Buffer struct {
	// contains filtered or unexported fields
}

func (*Buffer) Close

func (r *Buffer) Close() (err error)

func (*Buffer) Read

func (r *Buffer) Read(p []byte) (n int, err error)

func (*Buffer) Reader

func (r *Buffer) Reader() *bufio.Reader

func (*Buffer) Reset

func (r *Buffer) Reset()

type Capture

type Capture struct {
	// contains filtered or unexported fields
}

func NewCapture

func NewCapture(iface string, snaplen int, filter *Filter) *Capture

func (*Capture) Start

func (cap *Capture) Start(ctx context.Context) (err error)

func (*Capture) Stop

func (cap *Capture) Stop() (err error)

func (*Capture) WithHandle

func (cap *Capture) WithHandle(f HandleFunc) *Capture

type Filter

type Filter struct {
	IP   string `json:"ip"`
	Port int    `json:"port"`
	Host string `json:"host"`
	BPF  string `json:"bpf"`
}

func (*Filter) Match

func (filter *Filter) Match(host string) bool

type HandleFunc

type HandleFunc func(*httppkg.Request, *httppkg.Response)

type State

type State struct {
	NumOfCapture int
	// contains filtered or unexported fields
}

type Stream

type Stream struct {
	// contains filtered or unexported fields
}

func (*Stream) Accept

func (stream *Stream) Accept(tcp *layers.TCP, ci gopacket.CaptureInfo, dir reassembly.TCPFlowDirection, nextSeq reassembly.Sequence, start *bool, ac reassembly.AssemblerContext) bool

func (*Stream) NextRequest

func (stream *Stream) NextRequest() (req *httppkg.Request, res *httppkg.Response, err error)

func (*Stream) ReassembledSG

func (stream *Stream) ReassembledSG(sg reassembly.ScatterGather, ac reassembly.AssemblerContext)

func (*Stream) ReassemblyComplete

func (stream *Stream) ReassemblyComplete(ac reassembly.AssemblerContext) bool

type StreamFactory

type StreamFactory struct {
	// contains filtered or unexported fields
}

func NewFactory

func NewFactory(ctx context.Context, f HandleFunc) *StreamFactory

func (*StreamFactory) New

func (factory *StreamFactory) New(netFlow, tcpFlow gopacket.Flow, tcp *layers.TCP, ac reassembly.AssemblerContext) reassembly.Stream

func (*StreamFactory) Wait

func (factory *StreamFactory) Wait()