Documentation
¶
Overview ¶
Package filter exposes interfaces and implementations for packet capture
Package filter exposes interfaces and implementations for packet capture
Index ¶
- type AFPacketInfo
- type AFPacketSource
- func (p *AFPacketSource) Close()
- func (p *AFPacketSource) GetPacketInfoBuffer() *AFPacketInfo
- func (p *AFPacketSource) LayerType() gopacket.LayerType
- func (p *AFPacketSource) SetBPF(filter []bpf.RawInstruction) error
- func (p *AFPacketSource) SetEbpf(filter *manager.Probe) error
- func (p *AFPacketSource) VisitPackets(visit AFPacketVisitor) error
- type AFPacketVisitor
- type OptSnapLen
- type PacketInfo
- type PacketSource
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AFPacketInfo ¶
type AFPacketInfo struct {
// PktType corresponds to sll_pkttype in the
// sockaddr_ll struct; see packet(7)
// https://man7.org/linux/man-pages/man7/packet.7.html
PktType uint8
}
AFPacketInfo holds information about a packet
type AFPacketSource ¶
AFPacketSource provides a RAW_SOCKET attached to an eBPF SOCKET_FILTER
func NewAFPacketSource ¶
func NewAFPacketSource(size int, opts ...interface{}) (*AFPacketSource, error)
NewAFPacketSource creates an AFPacketSource using the provided BPF filter
func (*AFPacketSource) GetPacketInfoBuffer ¶
func (p *AFPacketSource) GetPacketInfoBuffer() *AFPacketInfo
GetPacketInfoBuffer returns a pointer to AFPacketInfo which is reused between calls
func (*AFPacketSource) LayerType ¶
func (p *AFPacketSource) LayerType() gopacket.LayerType
LayerType is the gopacket.LayerType for this source
func (*AFPacketSource) SetBPF ¶
func (p *AFPacketSource) SetBPF(filter []bpf.RawInstruction) error
SetBPF attaches a (classic) BPF socket filter to the AFPacketSource
func (*AFPacketSource) SetEbpf ¶
func (p *AFPacketSource) SetEbpf(filter *manager.Probe) error
SetEbpf attaches an eBPF socket filter to the AFPacketSource
func (*AFPacketSource) VisitPackets ¶
func (p *AFPacketSource) VisitPackets(visit AFPacketVisitor) error
VisitPackets starts reading packets from the source
type AFPacketVisitor ¶
type AFPacketVisitor = func(data []byte, info PacketInfo, t time.Time) error
AFPacketVisitor is the callback that AFPacketSource will trigger for packets The data buffer is reused between calls, so be careful
type OptSnapLen ¶
type OptSnapLen int
OptSnapLen specifies the maximum length of the packet to read
Defaults to 4096 bytes
type PacketInfo ¶
type PacketInfo interface{}
PacketInfo holds OS dependent packet information about a packet
type PacketSource ¶
type PacketSource interface {
// VisitPackets reads all new raw packets that are available, invoking the given callback for each packet.
// If no packet is available, VisitPacket blocks until OptPollTimeout and returns.
// The format of the packet is dependent on the implementation of PacketSource -- i.e. it may be an ethernet frame, or a IP frame.
// The data buffer is reused between invocations of VisitPacket and thus should not be pointed to.
// If the PacketSource is closed, VisitPackets will stop reading.
VisitPackets(visitor func(data []byte, info PacketInfo, timestamp time.Time) error) error
// LayerType returns the type of packet this source reads
LayerType() gopacket.LayerType
// Close closes the packet source. This will cancel VisitPackets if it is currently polling.
// Close() will not return until after VisitPackets has been canceled/returned.
Close()
}
PacketSource reads raw packet data