Documentation
¶
Overview ¶
The pcap package provides support for using the C pcap library from within a Go program. Not all of the functions exported by <pacp.h> have been included in this package and more will be added on request.
Index ¶
- Constants
- Variables
- func LibVersion() string
- func Statustostr(errnum int32) string
- type Pcap
- func (p *Pcap) Activate() error
- func (p *Pcap) BreakLoop()
- func (p *Pcap) Close()
- func (p *Pcap) Datalink() int32
- func (p *Pcap) DelayBreakLoop(t int)
- func (p *Pcap) GetErr() error
- func (p *Pcap) Getstats() (*stat.Stat, error)
- func (p *Pcap) Listen(r chan *[]*pkt.Packet)
- func (p *Pcap) Loop(cnt int)
- func (p *Pcap) LoopWithCallback(cnt int, callback func(*pkt.TcpPacket) bool)
- func (p *Pcap) LoopWithCallbackAllocless(cnt int, callback func(*pkt.TcpPacket) bool)
- func (p *Pcap) NewPktTrace(data *[]*pkt.Packet) (*trace.PktTrace, error)
- func (p *Pcap) Next() *pkt.Packet
- func (p *Pcap) NextEx() (*pkt.Packet, int32)
- func (p *Pcap) NextEx2() (pkt.TcpPacket, int32)
- func (p *Pcap) Open() error
- func (p *Pcap) OpenFile() error
- func (p *Pcap) SetBufferSize(bufferSize int32) error
- func (p *Pcap) SetPromisc(promisc bool) error
- func (p *Pcap) SetSnaplen(snaplen int32) error
- func (p *Pcap) SetTimeout(timeout_ms int32) error
- func (p *Pcap) Setfilter(expr string) error
Constants ¶
const ( DefaultBuffer = int32(102400) // buffer limit DefaultPromisc = int32(1) // 0->false, 1->true DefaultSnaplen = int32(65535) // number of bytes to capture per packet. DefaultTimeout = int32(0) // ms 0->no timeout )
Safe default values. These are probably far from optimal for most systems.
Variables ¶
var ( ChanBuffSize = 5000 // How many packets can we buffer in our channel. OptimizeFilters = 1 // Tells the bpf compiler to optimize filters. )
Functions ¶
func LibVersion ¶
func LibVersion() string
LibVersion returns information about the version of libpcap being used. Note that it contains more information than just a version number.
func Statustostr ¶
Statustostr returns error strings for PCAP_ERROR_ and PCAP_WARNING_ values.
Types ¶
type Pcap ¶
type Pcap struct {
FileName string // Used for pcap_open_offline
Device string // Used for pcap_open_live
Snaplen int32 // Specifies the maximum number of bytes to capture
Promisc int32 // 0->false, 1->true
Timeout int32 // ms
Filters []string // track filters applied to the capture
Pchan chan *pkt.Packet // Channel for passing Packet pointers
Packet pkt.TcpPacket // used by alloc-less version of loop
// contains filtered or unexported fields
}
Pcap is the wrapper for the pcap_t struct in <pcap.h>.
func Create ¶
Create will construct a pcap that can be used to set custom settings like a larger buffer. The resulting Pcap must then be started with a call to Activate. See Open for an example list of calls that should be made.
func OpenOffline ¶
OpenOffline returns a *Pcap and opens it to read pcap packets from a save file.
func (*Pcap) Close ¶
func (p *Pcap) Close()
Close closes the files associated with p and deallocates C resources.
func (*Pcap) Datalink ¶
Datalink returns the link layer type. For a list of possible DLT values see <pcap/bpf.h>.
func (*Pcap) DelayBreakLoop ¶
DelayBreakLoop stops the reading of packets after t seconds.
func (*Pcap) LoopWithCallback ¶
Callback version of Loop(). CB signals to quit returning true. CB may keep packet if it calls Save().
func (*Pcap) LoopWithCallbackAllocless ¶
Callback+allocless version of Loop(). CB signals to quit returning true. CB must not keep a ref to packet. It can use Clone() to get its own copy.
func (*Pcap) NewPktTrace ¶
NewPktTrace is a beta function and should be treated as such.
func (*Pcap) NextEx ¶
NextEx reads the next packet and returns a success/failure indication:
1 the packet was read without problems 0 packets are being read from a live capture, and the timeout expired
-1 an error occurred while reading the packet -2 packets are being read from a file, and there are no more packets to read
func (*Pcap) NextEx2 ¶
NextEx2 is just like NextEx, but returns only TCP/IPv4 packets. This packet creates no new heap allocations unless the previous packet was "saved" (it's Save() member was called)
func (*Pcap) Open ¶
Open creates a packet capture descriptor to look at packets on the network. Calling C.pcap_open_live is the equivalent of calling:
C.pcap_create C.pcap_set_snaplen C.pcap_set_promisc C.pcap_set_timeout C.pcap_activate
In that order. So if you want to use custom values for any thing that has to be set before pcap is active you should use Create instead of Open or OpenLive.
func (*Pcap) SetBufferSize ¶
SetBufferSize should only be called on a Pcap that was obtained through Create. If the buffer size is too small then Activate will fail with a generic PCAP_ERROR.
func (*Pcap) SetPromisc ¶
SetPromisc should only be called on a Pcap that was obtained through Create.
func (*Pcap) SetSnaplen ¶
SetSnaplen should only be called on a Pcap that was obtained through Create.
func (*Pcap) SetTimeout ¶
SetTimeout should only be called on a Pcap that was obtained through Create.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
The filter package provides support for assembling fell formed bpf filters.
|
The filter package provides support for assembling fell formed bpf filters. |
|
The pkt package provides access to the packet internals.
|
The pkt package provides access to the packet internals. |
|
The stat package provides support for collecting libpcap stats.
|
The stat package provides support for collecting libpcap stats. |