github.com/gopacket/gopacket@v1.1.0/pcapgo/doc.go (about)

     1  // Copyright 2018 The GoPacket Authors. All rights reserved.
     2  //
     3  // Use of this source code is governed by a BSD-style license
     4  // that can be found in the LICENSE file in the root of the source
     5  // tree.
     6  
     7  /*
     8  Package pcapgo provides some native PCAP support, not requiring C libpcap to be installed.
     9  
    10  # Overview
    11  
    12  This package contains implementations for native PCAP support. Currently supported are
    13  
    14    - pcap-files read/write: Reader, Writer
    15    - pcapng-files read/write: NgReader, NgWriter
    16    - raw socket capture (linux only): EthernetHandle
    17  
    18  # Basic Usage pcapng
    19  
    20  Pcapng files can be read and written. Reading supports both big and little endian files, packet blocks,
    21  simple packet blocks, enhanced packets blocks, interface blocks, and interface statistics blocks. All
    22  the options also by Wireshark are supported. The default reader options match libpcap behaviour. Have
    23  a look at NgReaderOptions for more advanced usage. Both ReadPacketData and ZeroCopyReadPacketData is
    24  supported (which means PacketDataSource and ZeroCopyPacketDataSource is supported).
    25  
    26  	f, err := os.Open("somefile.pcapng")
    27  	if err != nil {
    28  		...
    29  	}
    30  	defer f.Close()
    31  
    32  	r, err := NewNgReader(f, DefaultNgReaderOptions)
    33  	if err != nil {
    34  		...
    35  	}
    36  
    37  	data, ci, err := r.ReadPacketData()
    38  	...
    39  
    40  Write supports only little endian, enhanced packets blocks, interface blocks, and interface statistics
    41  blocks. The same options as with writing are supported. Interface timestamp resolution is fixed to
    42  10^-9s to match time.Time. Any other values are ignored. Upon creating a writer, a section, and an
    43  interface block is automatically written. Additional interfaces can be added at any time. Since
    44  the writer uses a bufio.Writer internally, Flush must be called before closing the file! Have a look
    45  at NewNgWriterInterface for more advanced usage.
    46  
    47  	f, err := os.Create("somefile.pcapng")
    48  	if err != nil {
    49  		...
    50  	}
    51  	defer f.Close()
    52  
    53  	r, err = NewNgWriter(f, layers.LinkTypeEthernet)
    54  	if err != nil {
    55  		...
    56  	}
    57  	defer r.Flush()
    58  
    59  	err = r.WritePacket(ci, data)
    60  	...
    61  */
    62  package pcapgo