pcap

package module
v0.0.0-...-599e2bd Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Feb 1, 2015 License: MIT Imports: 4 Imported by: 1

README

conntrack

Install

go get honnef.co/go/pcap

Documentation

Documentation can be found at godoc.org.

Documentation

Overview

Package pcap provides a basic, pure Go implementation for reading and writing pcap files.

Index

Examples

Constants

View Source 
const (
	// BSD loopback encapsulation; the link layer header is a 4-byte
	// field, in host byte order, containing a PF_ value from socket.h
	// for the network-layer protocol of the packet.
	DLT_NULL = 0
	// IEEE 802.3 Ethernet (10Mb, 100Mb, 1000Mb, and up); the 10MB in
	// the DLT_ name is historical.
	DLT_EN10MB = 1
	// AX.25 packet, with nothing preceding it.
	DLT_AX25 = 3
	// IEEE 802.5 Token Ring; the IEEE802, without _5, in the DLT_
	// name is historical.
	DLT_IEEE802 = 6
	// ARCNET Data Packets, as described by the ARCNET Trade
	// Association standard ATA 878.1-1999, but without the Starting
	// Delimiter, Information Length, or Frame Check Sequence fields,
	// and with only the first ISU of the Destination Identifier. For
	// most packet types, ARCNET Trade Association draft standard ATA
	// 878.2 is also used. See also RFC 1051 and RFC 1201; for RFC
	// 1051 frames, ATA 878.2 is not used.
	DLT_ARCNET = 7
	// SLIP, encapsulated with a LINKTYPE_SLIP header.
	DLT_SLIP = 8
	// PPP, as per RFC 1661 and RFC 1662; if the first 2 bytes are
	// 0xff and 0x03, it's PPP in HDLC-like framing, with the PPP
	// header following those two bytes, otherwise it's PPP without
	// framing, and the packet begins with the PPP header.
	DLT_PPP = 9
	// FDDI, as specified by ANSI INCITS 239-1994.
	DLT_FDDI = 10
	// PPP in HDLC-like framing, as per RFC 1662, or Cisco PPP with
	// HDLC framing, as per section 4.3.1 of RFC 1547; the first byte
	// will be 0xFF for PPP in HDLC-like framing, and will be 0x0F or
	// 0x8F for Cisco PPP with HDLC framing.
	DLT_PPP_SERIAL = 50
	// PPPoE; the packet begins with a PPPoE header, as per RFC 2516.
	DLT_PPP_ETHER = 51
	// RFC 1483 LLC/SNAP-encapsulated ATM; the packet begins with an
	// IEEE 802.2 LLC header.
	DLT_ATM_RFC1483 = 100
	// Raw IP; the packet begins with an IPv4 or IPv6 header, with the
	// "version" field of the header indicating whether it's an IPv4
	// or IPv6 header.
	DLT_RAW = 101
	// Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547.
	DLT_C_HDLC = 104
	// IEEE 802.11 wireless LAN.
	DLT_IEEE802_11 = 105
	// Frame Relay
	DLT_FRELAY = 107
	// OpenBSD loopback encapsulation; the link-layer header is a
	// 4-byte field, in network byte order, containing a PF_ value
	// from OpenBSD's socket.h for the network-layer protocol of the
	// packet.
	DLT_LOOP = 108
	// Linux "cooked" capture encapsulation.
	DLT_LINUX_SLL = 113
	// Apple LocalTalk; the packet begins with an AppleTalk LocalTalk
	// Link Access Protocol header, as described in chapter 1 of
	// Inside AppleTalk, Second Edition.
	DLT_LTALK = 114
	// OpenBSD pflog; the link-layer header contains a "struct
	// pfloghdr" structure, as defined by the host on which the file
	// was saved. (This differs from operating system to operating
	// system and release to release; there is nothing in the file to
	// indicate what the layout of that structure is.)
	DLT_PFLOG = 117
	// Prism monitor mode information followed by an 802.11 header.
	DLT_PRISM_HEADER = 119
	// RFC 2625 IP-over-Fibre Channel, with the link-layer header
	// being the Network_Header as described in that RFC.
	DLT_IP_OVER_FC = 122
	// ATM traffic, encapsulated as per the scheme used by SunATM
	// devices.
	DLT_SUNATM = 123
	// Radiotap link-layer information followed by an 802.11 header.
	DLT_IEEE802_11_RADIO = 127
	// ARCNET Data Packets, as described by the ARCNET Trade
	// Association standard ATA 878.1-1999, but without the Starting
	// Delimiter, Information Length, or Frame Check Sequence fields,
	// with only the first ISU of the Destination Identifier, and with
	// an extra two-ISU "offset" field following the Destination
	// Identifier. For most packet types, ARCNET Trade Association
	// draft standard ATA 878.2 is also used; however, no exception
	// frames are supplied, and reassembled frames, rather than
	// fragments, are supplied. See also RFC 1051 and RFC 1201; for
	// RFC 1051 frames, ATA 878.2 is not used.
	DLT_ARCNET_LINUX = 129
	// Apple IP-over-IEEE 1394 cooked header.
	DLT_APPLE_IP_OVER_IEEE1394 = 138
	// Signaling System 7 Message Transfer Part Level 2, as specified
	// by ITU-T Recommendation Q.703, preceded by a pseudo-header.
	DLT_MTP2_WITH_PHDR = 139
	// Signaling System 7 Message Transfer Part Level 2, as specified
	// by ITU-T Recommendation Q.703.
	DLT_MTP2 = 140
	// Signaling System 7 Message Transfer Part Level 3, as specified
	// by ITU-T Recommendation Q.704, with no MTP2 header preceding
	// the MTP3 packet.
	DLT_MTP3 = 141
	// Signaling System 7 Signalling Connection Control Part, as
	// specified by ITU-T Recommendation Q.711, ITU-T Recommendation
	// Q.712, ITU-T Recommendation Q.713, and ITU-T Recommendation
	// Q.714, with no MTP3 or MTP2 headers preceding the SCCP packet.
	DLT_SCCP = 142
	// DOCSIS MAC frames, as described by the DOCSIS 3.0 MAC and Upper
	// Layer Protocols Interface Specification.
	DLT_DOCSIS = 143
	// Linux-IrDA packets, with a LINKTYPE_LINUX_IRDA header, with the
	// payload for IrDA frames beginning with by the IrLAP header as
	// defined by IrDA Data Specifications, including the IrDA Link
	// Access Protocol specification.
	DLT_LINUX_IRDA = 144
	// AVS monitor mode information followed by an 802.11 header.
	DLT_IEEE802_11_RADIO_AVS = 163
	// BACnet MS/TP frames, as specified by section 9.3 MS/TP Frame
	// Format of ANSI/ASHRAE Standard 135, BACnet® - A Data
	// Communication Protocol for Building Automation and Control
	// Networks, including the preamble and, if present, the Data CRC.
	DLT_BACNET_MS_TP = 165
	// PPP in HDLC-like encapsulation, but with the 0xff address byte
	// replaced by a direction indication - 0x00 for incoming and 0x01
	// for outgoing.
	DLT_PPP_PPPD = 166
	// General Packet Radio Service Logical Link Control, as defined
	// by 3GPP TS 04.64.
	DLT_GPRS_LLC = 169
	// Link Access Procedures on the D Channel (LAPD) frames, as
	// specified by ITU-T Recommendation Q.920 and ITU-T
	// Recommendation Q.921, captured via vISDN, with a
	// LINKTYPE_LINUX_LAPD header, followed by the Q.921 frame,
	// starting with the address field.
	DLT_LINUX_LAPD = 177
	// Bluetooth HCI UART transport layer; the frame contains an HCI
	// packet indicator byte, as specified by Volume 4, part A of the
	// Core Version 4.0 of the Bluetooth specifications, followed by
	// an HCI packet of the specified packet type, as specified by
	// Volume 2, Part E of the same document.
	DLT_BLUETOOTH_HCI_H4 = 187
	// USB packets, beginning with a Linux USB header, as specified by
	// the struct usbmon_packet in the Documentation/usb/usbmon.txt
	// file in the Linux source tree. Only the first 48 bytes of that
	// header are present. All fields in the header are in the host
	// byte order for the pcap file, as specified by the file's magic
	// number, or for the section of the pcap-ng file, as specified by
	// the Section Header Block.
	DLT_USB_LINUX = 189
	// Per-Packet Information information, as specified by the
	// Per-Packet Information Header Specification, followed by a
	// packet with the LINKTYPE_ value specified by the pph_dlt field
	// of that header.
	DLT_PPI = 192
	// IEEE 802.15.4 wireless Personal Area Network, with each packet
	// having the FCS at the end of the frame.
	DLT_IEEE802_15_4 = 195
	// Various link-layer types, with a pseudo-header, for SITA.
	DLT_SITA = 196
	// Various link-layer types, with a pseudo-header, for Endace DAG
	// cards; encapsulates Endace ERF records.
	DLT_ERF = 197
	// Bluetooth HCI UART transport layer; the frame contains a 4-byte
	// direction field, in network byte order (big-endian), the
	// low-order bit of which is set if the frame was sent from the
	// host to the controller and clear if the frame was received by
	// the host from the controller, followed by an HCI packet
	// indicator byte, as specified by Volume 4, part A of the Core
	// Version 4.0 of the Bluetooth specifications, followed by an HCI
	// packet of the specified packet type, as specified by Volume 2,
	// Part E of the same document.
	DLT_BLUETOOTH_HCI_H4_WITH_PHDR = 201
	// AX.25 packet, with a 1-byte KISS header containing a type
	// indicator.
	DLT_AX25_KISS = 202
	// Link Access Procedures on the D Channel (LAPD) frames, as
	// specified by ITU-T Recommendation Q.920 and ITU-T
	// Recommendation Q.921, starting with the address field, with no
	// pseudo-header.
	DLT_LAPD = 203
	// PPP, as per RFC 1661 and RFC 1662, preceded with a one-byte
	// pseudo-header with a zero value meaning "received by this host"
	// and a non-zero value meaning "sent by this host".
	DLT_PPP_WITH_DIR = 204
	// Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547,
	// preceded with a one-byte pseudo-header with a zero value
	// meaning "received by this host" and a non-zero value meaning
	// "sent by this host".
	DLT_C_HDLC_WITH_DIR = 205
	// Frame Relay, preceded with a one-byte pseudo-header with a zero
	// value meaning "received by this host" and a non-zero value
	// meaning "sent by this host".
	DLT_FRELAY_WITH_DIR = 206
	// IPMB over an I2C circuit, with a Linux-specific pseudo-header.
	DLT_IPMB_LINUX = 209
	// IEEE 802.15.4 wireless Personal Area Network, with each packet
	// having the FCS at the end of the frame, and with the PHY-level
	// data for non-ASK PHYs (4 octets of 0 as preamble, one octet of
	// SFD, one octet of frame length + reserved bit) preceding the
	// MAC-layer data (starting with the frame control field).
	DLT_IEEE802_15_4_NONASK_PHY = 215
	// USB packets, beginning with a Linux USB header, as specified by
	// the struct usbmon_packet in the Documentation/usb/usbmon.txt
	// file in the Linux source tree. All 64 bytes of the header are
	// present. All fields in the header are in the host byte order
	// for the pcap file, as specified by the file's magic number, or
	// for the section of the pcap-ng file, as specified by the
	// Section Header Block. For isochronous transfers, the ndesc
	// field specifies the number of isochronous descriptors that
	// follow.
	DLT_USB_LINUX_MMAPPED = 220
	// Fibre Channel FC-2 frames, beginning with a Frame_Header.
	DLT_FC_2 = 224
	// Fibre Channel FC-2 frames, beginning an encoding of the SOF,
	// followed by a Frame_Header, and ending with an encoding of the
	// SOF.
	DLT_FC_2_WITH_FRAME_DELIMS = 225
	// Solaris ipnet pseudo-header, followed by an IPv4 or IPv6
	// datagram.
	DLT_IPNET = 226
	// CAN (Controller Area Network) frames, with a pseudo-header as
	// supplied by Linux SocketCAN.
	DLT_CAN_SOCKETCAN = 227
	// Raw IPv4; the packet begins with an IPv4 header.
	DLT_IPV4 = 228
	// Raw IPv6; the packet begins with an IPv6 header.
	DLT_IPV6 = 229
	// IEEE 802.15.4 wireless Personal Area Network, without the FCS
	// at the end of the frame.
	DLT_IEEE802_15_4_NOFCS = 230
	// Raw D-Bus messages, starting with the endianness flag, followed
	// by the message type, etc., but without the authentication
	// handshake before the message sequence.
	DLT_DBUS = 231
	// DVB-CI (DVB Common Interface for communication between a PC
	// Card module and a DVB receiver), with the message format
	// specified by the PCAP format for DVB-CI specification.
	DLT_DVB_CI = 235
	// Variant of 3GPP TS 27.010 multiplexing protocol (similar to,
	// but not the same as, 27.010).
	DLT_MUX27010 = 236
	// D_PDUs as described by NATO standard STANAG 5066, starting with
	// the synchronization sequence, and including both header and
	// data CRCs. The current version of STANAG 5066 is
	// backwards-compatible with the 1.0.2 version, although newer
	// versions are classified.
	DLT_STANAG_5066_D_PDU = 237
	// Linux netlink NETLINK NFLOG socket log messages.
	DLT_NFLOG = 239
	// Pseudo-header for Hilscher Gesellschaft für Systemautomation
	// mbH netANALYZER devices, followed by an Ethernet frame,
	// beginning with the MAC header and ending with the FCS.
	DLT_NETANALYZER = 240
	// Pseudo-header for Hilscher Gesellschaft für Systemautomation
	// mbH netANALYZER devices, followed by an Ethernet frame,
	// beginning with the preamble, SFD, and MAC header, and ending
	// with the FCS.
	DLT_NETANALYZER_TRANSPARENT = 241
	// IP-over-InfiniBand, as specified by RFC 4391 section 6.
	DLT_IPOIB = 242
	// MPEG-2 Transport Stream transport packets, as specified by ISO
	// 13818-1/ITU-T Recommendation H.222.0 (see table 2-2 of section
	// 2.4.3.2 "Transport Stream packet layer").
	DLT_MPEG_2_TS = 243
	// Pseudo-header for ng4T GmbH's UMTS Iub/Iur-over-ATM and
	// Iub/Iur-over-IP format as used by their ng40 protocol tester,
	// followed by frames for the Frame Protocol as specified by 3GPP
	// TS 25.427 for dedicated channels and 3GPP TS 25.435 for
	// common/shared channels in the case of ATM AAL2 or UDP traffic,
	// by SSCOP packets as specified by ITU-T Recommendation Q.2110
	// for ATM AAL5 traffic, and by NBAP packets for SCTP traffic.
	DLT_NG40 = 244
	// Pseudo-header for NFC LLCP packet captures, followed by frame
	// data for the LLCP Protocol as specified by
	// NFCForum-TS-LLCP_1.1.
	DLT_NFC_LLCP = 245
	// Raw InfiniBand frames, starting with the Local Routing Header,
	// as specified in Chapter 5 "Data packet format" of InfiniBand™
	// Architectural Specification Release 1.2.1 Volume 1 - General
	// Specifications.
	DLT_INFINIBAND = 247
	// SCTP packets, as defined by RFC 4960, with no lower-level
	// protocols such as IPv4 or IPv6.
	DLT_SCTP = 248
	// USB packets, beginning with a USBPcap header.
	DLT_USBPCAP = 249
	// Serial-line packet header for the Schweitzer Engineering
	// Laboratories "RTAC" product, followed by a payload for one of a
	// number of industrial control protocols.
	DLT_RTAC_SERIAL = 250
	// Bluetooth Low Energy air interface Link Layer packets, in the
	// format described in section 2.1 "PACKET FORMAT" of volume 6 of
	// the Bluetooth Specification Version 4.0 (see PDF page 2200),
	// but without the Preamble.
	DLT_BLUETOOTH_LE_LL = 251
)

Variables

This section is empty.

Functions

This section is empty.

Types

type Bytes 

type Bytes []byte

The Bytes type implements the Payload interface by returning itself and is used for the Data of packets read from a pcap file.

func (Bytes) Payload 

func (b Bytes) Payload() []byte

type DLT 

type DLT uint32
type GlobalHeader struct {
	// The major version of the pcap format. Should be 2.
	VersionMajor uint16
	// The minor version of the pcap format. Should be 4.
	VersionMinor uint16
	// The time offset of packet timestamps to UTC. When writing
	// packages, this field should be 0.
	ZoneCorrection int32
	// The accuracy of time stamps. Usually set to 0.
	TimestampAccuracy uint32
	// The snapshot length for the capture.
	SnapshotLength uint32
	// The link-layer header type encapsulating all packets.
	Network DLT
	// True if timestamps use nanosecond precision. Note that not all
	// tools support this.
	Nanosecond bool
	// The byte order used to store headers.
	ByteOrder binary.ByteOrder
}

type Packet 

type Packet struct {
	Header PacketHeader
	Data   Payload
}

type PacketHeader 

type PacketHeader struct {
	// The time of capture.
	Timestamp time.Time
	// The number of bytes of the packet that were actually saved.
	// This will be at most GlobalHeader.SnapshotLength bytes.
	SavedLength uint32
	// The actual length of the packet when it was captured.
	OriginalLength uint32
}

type Payload 

type Payload interface {
	Payload() []byte
}

The Payload interface is primarily used when writing packets to a pcap file. Upon calling WritePacket, the Payload() method will be called exactly once.

type Reader 

type Reader struct {
	Header GlobalHeader
	// contains filtered or unexported fields
}

Reader allows reading of pcap files.

func NewReader 

func NewReader(r io.Reader) *Reader

NewReader returns a new pcap reader. It does not call ParseHeader.

func (*Reader) ParseHeader 

func (p *Reader) ParseHeader() error

ParseHeader parses the global pcap header.

func (*Reader) ReadPacket 

func (p *Reader) ReadPacket() (Packet, error)

ReadPacket reads the next packet from the pcap file. It will return io.EOF if there are no more packages, io.ErrUnexpectedEOF on short reads or a different error in case of invalid data.

type Writer 

type Writer struct {
	Header GlobalHeader
	// contains filtered or unexported fields
}

Writer allows writing of pcap files.

func NewWriter 

func NewWriter(w io.Writer) *Writer

NewWriter creates a new Writer. SnapshotLength will be set to 65535 and the byte order will default to little endian. Upon receiving the writer you will need to at least set the DLT. You can also adjust the snapshot length as well as the byte order and enable nanosecond precision.

If appending packets to an existing file, make sure that the header matches the existing header in the file, for example by using a Reader to extract and copy the header.

Example 
w := NewWriter(ioutil.Discard)
w.Header.Network = DLT_EN10MB
w.WriteHeader()
// write packets here

Output:
Example (Append) 
// Append to an existing capture by copying the header

f, _ := os.Open("capture.pcap")
r := NewReader(f)
r.ParseHeader()
f.Close()

f, _ = os.OpenFile("capture.pcap", os.O_APPEND, 0666)
defer f.Close()
w := NewWriter(f)
w.Header = r.Header

// write packets here

Output:

func (*Writer) WriteHeader 

func (p *Writer) WriteHeader() error

WriteHeader writes the global pcap header. This must be called exactly once if creating a new file. If appending to an existing file, this method must not be called.

func (*Writer) WritePacket 

func (p *Writer) WritePacket(packet Packet) error

WritePacket writes a packet to the pcap file. When creating a packet, the header is optional and will be filled in by WritePacket. You can, however, specify a header to set the timestamp or the captured packet length. All other fields will be ignored.

Example 
w := NewWriter(ioutil.Discard)
w.Header.Network = DLT_EN10MB
w.WriteHeader()

// Please note that the Ethernet type is not defined in the pcap
// package.
frame := &Ethernet{
	Destination: [6]byte{0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
	Source:      [6]byte{1, 2, 3, 4, 5, 6},
	Type:        0x0800,
	Data:        Bytes("Actual IPv4 payload here"),
}
// By not explicitly specifying a header with a timestamp, the
// current time will be used.
w.WritePacket(Packet{Data: frame})

w.WritePacket(Packet{
	// Specify a timestamp
	Header: PacketHeader{Timestamp: time.Unix(1234567, 0)},
	Data:   frame,
})

Output:

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.