Documentation
¶
Overview ¶
Interface to both live and offline pcap parsing.
Index ¶
- Constants
- func DatalinkValueToDescription(dlt int) string
- func DatalinkValueToName(dlt int) string
- func Version() string
- type Arphdr
- type FileHeader
- type IFAddress
- type Icmphdr
- type Interface
- type Ip6hdr
- type Iphdr
- type Packet
- type PacketTime
- type Pcap
- func (p *Pcap) Close()
- func (p *Pcap) Datalink() int
- func (p *Pcap) Geterror() error
- func (p *Pcap) Getstats() (stat *Stat, err error)
- func (p *Pcap) Inject(data []byte) (err error)
- func (p *Pcap) Next() (pkt *Packet)
- func (p *Pcap) NextEx() (pkt *Packet, result int32)
- func (p *Pcap) Setdatalink(dlt int) error
- func (p *Pcap) Setfilter(expr string) (err error)
- type Reader
- type Stat
- type Tcphdr
- type Udphdr
- type Vlanhdr
- type Writer
Constants ¶
View Source
const ( TYPE_IP = 0x0800 TYPE_ARP = 0x0806 TYPE_IP6 = 0x86DD TYPE_VLAN = 0x8100 IP_ICMP = 1 IP_INIP = 4 IP_TCP = 6 IP_UDP = 17 )
View Source
const ( ERRBUF_SIZE = 256 // According to pcap-linktype(7). LINKTYPE_NULL = 0 LINKTYPE_ETHERNET = 1 LINKTYPE_TOKEN_RING = 6 LINKTYPE_ARCNET = 7 LINKTYPE_SLIP = 8 LINKTYPE_PPP = 9 LINKTYPE_FDDI = 10 LINKTYPE_ATM_RFC1483 = 100 LINKTYPE_RAW = 101 LINKTYPE_PPP_HDLC = 50 LINKTYPE_PPP_ETHER = 51 LINKTYPE_C_HDLC = 104 LINKTYPE_IEEE802_11 = 105 LINKTYPE_FRELAY = 107 LINKTYPE_LOOP = 108 LINKTYPE_LINUX_SLL = 113 LINKTYPE_LTALK = 104 LINKTYPE_PFLOG = 117 LINKTYPE_PRISM_HEADER = 119 LINKTYPE_IP_OVER_FC = 122 LINKTYPE_SUNATM = 123 LINKTYPE_IEEE802_11_RADIO = 127 LINKTYPE_ARCNET_LINUX = 129 LINKTYPE_LINUX_IRDA = 144 LINKTYPE_LINUX_LAPD = 177 )
View Source
const ( TCP_FIN = 1 << iota TCP_SYN TCP_RST TCP_PSH TCP_ACK TCP_URG TCP_ECE TCP_CWR TCP_NS )
Variables ¶
This section is empty.
Functions ¶
func DatalinkValueToName ¶
Types ¶
type Arphdr ¶
type Arphdr struct {
Addrtype uint16
Protocol uint16
HwAddressSize uint8
ProtAddressSize uint8
Operation uint16
SourceHwAddress []byte
SourceProtAddress []byte
DestHwAddress []byte
DestProtAddress []byte
}
Arphdr is a ARP packet header.
type FileHeader ¶
type FileHeader struct {
MagicNumber uint32
VersionMajor uint16
VersionMinor uint16
TimeZone int32
SigFigs uint32
SnapLen uint32
Network uint32
}
FileHeader is the parsed header of a pcap file. http://wiki.wireshark.org/Development/LibpcapFileFormat
type Icmphdr ¶
func (*Icmphdr) TypeString ¶
type Interface ¶
func Findalldevs ¶
type Ip6hdr ¶
type Ip6hdr struct {
// http://www.networksorcery.com/enp/protocol/ipv6.htm
Version uint8 // 4 bits
TrafficClass uint8 // 8 bits
FlowLabel uint32 // 20 bits
Length uint16 // 16 bits
NextHeader uint8 // 8 bits, same as Protocol in Iphdr
HopLimit uint8 // 8 bits
SrcIp []byte // 16 bytes
DestIp []byte // 16 bytes
}
type Iphdr ¶
type Iphdr struct {
Version uint8
Ihl uint8
Tos uint8
Length uint16
Id uint16
Flags uint8
FragOffset uint16
Ttl uint8
Protocol uint8
Checksum uint16
SrcIp []byte
DestIp []byte
}
IPadr is the header of an IP packet.
type Packet ¶
type Packet struct {
Time time.Time // packet send/receive time
Caplen uint32 // bytes stored in the file (caplen <= len)
Len uint32 // bytes sent/received
Data []byte // packet data
Type int // protocol type, see LINKTYPE_*
DestMac uint64
SrcMac uint64
Headers []interface{} // decoded headers, in order
Payload []byte // remaining non-header bytes
IP *Iphdr // IP header (for IP packets, after decoding)
TCP *Tcphdr // TCP header (for TCP packets, after decoding)
UDP *Udphdr // UDP header (for UDP packets after decoding)
}
Packet is a single packet parsed from a pcap file.
Convenient access to IP, TCP, and UDP headers is provided after Decode() is called if the packet is of the appropriate type.
type PacketTime ¶
func (*PacketTime) Time ¶
func (p *PacketTime) Time() time.Time
Convert the PacketTime to a go Time struct.
type Pcap ¶
type Pcap struct {
// contains filtered or unexported fields
}
func Openlive ¶
func Openlive(device string, snaplen int32, promisc bool, timeout_ms int32) (handle *Pcap, err error)
Openlive opens a device and returns a *Pcap handler
func Openoffline ¶
func (*Pcap) Setdatalink ¶
type Reader ¶
type Reader struct {
Header FileHeader
// contains filtered or unexported fields
}
Reader parses pcap files.
type Tcphdr ¶
type Tcphdr struct {
SrcPort uint16
DestPort uint16
Seq uint32
Ack uint32
DataOffset uint8
Flags uint16
Window uint16
Checksum uint16
Urgent uint16
Data []byte
}
func (*Tcphdr) FlagsString ¶
type Vlanhdr ¶
Click to show internal directories.
Click to hide internal directories.