Documentation
¶
Overview ¶
Package capture wraps libpcap so the engine sees one interface whether packets come from a live NIC or a saved capture file.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Interfaces ¶
Interfaces lists capture devices with their addresses.
Types ¶
type LiveConfig ¶
type LiveConfig struct {
// Interface is the device name, e.g. "en0".
Interface string
// SnapLen caps bytes captured per packet.
SnapLen int
// Promiscuous puts the interface in promiscuous mode.
Promiscuous bool
// Timeout is how long the kernel may buffer packets before delivering
// them. Lower means fresher events and more syscalls.
Timeout time.Duration
// BPF is an optional capture filter applied in the kernel.
BPF string
}
LiveConfig configures a live capture.
type Source ¶
type Source interface {
gopacket.PacketDataSource
// Decoder decodes a frame's outermost layer. libpcap reports this as a
// link type, which is itself a gopacket.Decoder.
Decoder() gopacket.Decoder
// Description names the source for logging.
Description() string
// Stats reports libpcap's counters. A capture file has none, so ok is
// false for offline sources.
Stats() (Stats, bool)
Close()
}
Source yields packets. Close must be called when done.
func OpenLive ¶
func OpenLive(cfg LiveConfig) (Source, error)
OpenLive starts capturing from a network interface. It needs elevated privileges on most systems (root, or CAP_NET_RAW on Linux).
type Stats ¶
type Stats struct {
Received uint64 `json:"received"`
Dropped uint64 `json:"dropped"`
IfDropped uint64 `json:"if_dropped"`
}
Stats are libpcap's own counters for a capture.
Dropped is what the kernel discarded because percept did not read fast enough; IfDropped is what the interface discarded before the kernel saw it. Either means events are missing, which is worth knowing about rather than inferring from a suspiciously quiet log.
Source Files