filter

package
v0.0.0-...-a5a9a89 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: May 20, 2026 License: Apache-2.0 Imports: 16 Imported by: 0

Documentation

Overview

Package filter exposes interfaces and implementations for packet capture

Package filter exposes interfaces and implementations for packet capture

Index

Constants

View Source
const (
	PacketHost      = unix.PACKET_HOST
	PacketBroadcast = unix.PACKET_BROADCAST
	PacketMulticast = unix.PACKET_MULTICAST
	PacketOtherHost = unix.PACKET_OTHERHOST
	PacketOutgoing  = unix.PACKET_OUTGOING
)

On Linux, alias the constants from the unix package for consistency with Darwin

Variables

This section is empty.

Functions

This section is empty.

Types

type AFPacketInfo

type AFPacketInfo struct {
	// PktType corresponds to sll_pkttype in the
	// sockaddr_ll struct; see packet(7)
	// https://man7.org/linux/man-pages/man7/packet.7.html
	PktType uint8
}

AFPacketInfo holds information about a packet

func (*AFPacketInfo) LinkLayerType

func (a *AFPacketInfo) LinkLayerType() gopacket.LayerType

LinkLayerType returns the gopacket layer type for this packet. Linux AF_PACKET always delivers Ethernet frames.

func (*AFPacketInfo) PacketType

func (a *AFPacketInfo) PacketType() uint8

PacketType returns the packet direction type

type AFPacketSource

type AFPacketSource struct {
	*afpacket.TPacket
	// contains filtered or unexported fields
}

AFPacketSource provides a RAW_SOCKET attached to an eBPF SOCKET_FILTER

func NewAFPacketSource

func NewAFPacketSource(size uint32, opts ...Option) (*AFPacketSource, error)

NewAFPacketSource creates an AFPacketSource using the provided BPF filter

func (*AFPacketSource) Close

func (p *AFPacketSource) Close()

Close stops packet reading

func (*AFPacketSource) GetPacketInfoBuffer

func (p *AFPacketSource) GetPacketInfoBuffer() *AFPacketInfo

GetPacketInfoBuffer returns a pointer to AFPacketInfo which is reused between calls

func (*AFPacketSource) LayerType

func (p *AFPacketSource) LayerType() gopacket.LayerType

LayerType is the gopacket.LayerType for this source

func (*AFPacketSource) SetBPF

func (p *AFPacketSource) SetBPF(filter []bpf.RawInstruction) error

SetBPF attaches a (classic) BPF socket filter to the AFPacketSource

func (*AFPacketSource) SetEbpf

func (p *AFPacketSource) SetEbpf(filter *manager.Probe) error

SetEbpf attaches an eBPF socket filter to the AFPacketSource

func (*AFPacketSource) VisitPackets

func (p *AFPacketSource) VisitPackets(visit AFPacketVisitor) error

VisitPackets starts reading packets from the source

type AFPacketVisitor

type AFPacketVisitor = func(data []byte, info PacketInfo, t time.Time) error

AFPacketVisitor is the callback that AFPacketSource will trigger for packets The data buffer is reused between calls, so be careful

type Option

type Option func(*packetSourceConfig)

Option configures AFPacketSource

func OptSnapLen

func OptSnapLen(v uint16) Option

OptSnapLen specifies the maximum length of the packet to read

Defaults to 4096 bytes

type PacketInfo

type PacketInfo interface {
	// PacketType returns the packet direction type
	// (e.g. PacketHost, PacketOutgoing)
	PacketType() uint8
	// LinkLayerType returns the gopacket layer type for this
	// packet's link-layer encapsulation
	LinkLayerType() gopacket.LayerType
}

PacketInfo holds OS dependent packet information about a packet

type PacketSource

type PacketSource interface {
	// VisitPackets reads all new raw packets that are available, invoking the given callback for each packet.
	// If no packet is available, VisitPacket blocks until OptPollTimeout and returns.
	// The format of the packet is dependent on the implementation of PacketSource -- i.e. it may be an ethernet frame, or a IP frame.
	// The data buffer is reused between invocations of VisitPacket and thus should not be pointed to.
	// If the PacketSource is closed, VisitPackets will stop reading.
	VisitPackets(visitor func(data []byte, info PacketInfo, timestamp time.Time) error) error

	// LayerType returns the type of packet this source reads
	LayerType() gopacket.LayerType

	// Close closes the packet source. This will cancel VisitPackets if it is currently polling.
	// Close() will not return until after VisitPackets has been canceled/returned.
	Close()
}

PacketSource reads raw packet data

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL