Documentation
¶
Overview ¶
Package filter exposes interfaces and implementations for packet capture
Package filter exposes interfaces and implementations for packet capture
Index ¶
- Constants
- type AFPacketInfo
- type AFPacketSource
- func (p *AFPacketSource) Close()
- func (p *AFPacketSource) GetPacketInfoBuffer() *AFPacketInfo
- func (p *AFPacketSource) LayerType() gopacket.LayerType
- func (p *AFPacketSource) SetBPF(filter []bpf.RawInstruction) error
- func (p *AFPacketSource) SetEbpf(filter *manager.Probe) error
- func (p *AFPacketSource) VisitPackets(visit AFPacketVisitor) error
- type AFPacketVisitor
- type OptSnapLen
- type PacketInfo
- type PacketSource
Constants ¶
const ( PacketHost = unix.PACKET_HOST PacketBroadcast = unix.PACKET_BROADCAST PacketMulticast = unix.PACKET_MULTICAST PacketOtherHost = unix.PACKET_OTHERHOST PacketOutgoing = unix.PACKET_OUTGOING )
On Linux, alias the constants from the unix package for consistency with Darwin
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AFPacketInfo ¶
type AFPacketInfo struct {
// PktType corresponds to sll_pkttype in the
// sockaddr_ll struct; see packet(7)
// https://man7.org/linux/man-pages/man7/packet.7.html
PktType uint8
}
AFPacketInfo holds information about a packet
func (*AFPacketInfo) LinkLayerType ¶
func (a *AFPacketInfo) LinkLayerType() gopacket.LayerType
LinkLayerType returns the gopacket layer type for this packet. Linux AF_PACKET always delivers Ethernet frames.
func (*AFPacketInfo) PacketType ¶
func (a *AFPacketInfo) PacketType() uint8
PacketType returns the packet direction type
type AFPacketSource ¶
AFPacketSource provides a RAW_SOCKET attached to an eBPF SOCKET_FILTER
func NewAFPacketSource ¶
func NewAFPacketSource(size int, opts ...interface{}) (*AFPacketSource, error)
NewAFPacketSource creates an AFPacketSource using the provided BPF filter
func (*AFPacketSource) GetPacketInfoBuffer ¶
func (p *AFPacketSource) GetPacketInfoBuffer() *AFPacketInfo
GetPacketInfoBuffer returns a pointer to AFPacketInfo which is reused between calls
func (*AFPacketSource) LayerType ¶
func (p *AFPacketSource) LayerType() gopacket.LayerType
LayerType is the gopacket.LayerType for this source
func (*AFPacketSource) SetBPF ¶
func (p *AFPacketSource) SetBPF(filter []bpf.RawInstruction) error
SetBPF attaches a (classic) BPF socket filter to the AFPacketSource
func (*AFPacketSource) SetEbpf ¶
func (p *AFPacketSource) SetEbpf(filter *manager.Probe) error
SetEbpf attaches an eBPF socket filter to the AFPacketSource
func (*AFPacketSource) VisitPackets ¶
func (p *AFPacketSource) VisitPackets(visit AFPacketVisitor) error
VisitPackets starts reading packets from the source
type AFPacketVisitor ¶
type AFPacketVisitor = func(data []byte, info PacketInfo, t time.Time) error
AFPacketVisitor is the callback that AFPacketSource will trigger for packets The data buffer is reused between calls, so be careful
type OptSnapLen ¶
type OptSnapLen int
OptSnapLen specifies the maximum length of the packet to read
Defaults to 4096 bytes
type PacketInfo ¶
type PacketInfo interface {
// PacketType returns the packet direction type
// (e.g. PacketHost, PacketOutgoing)
PacketType() uint8
// LinkLayerType returns the gopacket layer type for this
// packet's link-layer encapsulation
LinkLayerType() gopacket.LayerType
}
PacketInfo holds OS dependent packet information about a packet
type PacketSource ¶
type PacketSource interface {
// VisitPackets reads all new raw packets that are available, invoking the given callback for each packet.
// If no packet is available, VisitPacket blocks until OptPollTimeout and returns.
// The format of the packet is dependent on the implementation of PacketSource -- i.e. it may be an ethernet frame, or a IP frame.
// The data buffer is reused between invocations of VisitPacket and thus should not be pointed to.
// If the PacketSource is closed, VisitPackets will stop reading.
VisitPackets(visitor func(data []byte, info PacketInfo, timestamp time.Time) error) error
// LayerType returns the type of packet this source reads
LayerType() gopacket.LayerType
// Close closes the packet source. This will cancel VisitPackets if it is currently polling.
// Close() will not return until after VisitPackets has been canceled/returned.
Close()
}
PacketSource reads raw packet data