filter

package
v1.0.10 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 16, 2025 License: Apache-2.0 Imports: 5 Imported by: 1

Documentation

Index

Constants

This section is empty.

Variables

View Source
var (

	// CaptureLengthFixed denotes a simple fixed snaplen strategy
	CaptureLengthFixed = func(snaplen int) CaptureLengthStrategy {
		return func(*link.Link) int {
			return snaplen
		}
	}

	// CaptureLengthMinimalIPv4Header indicates that the minimal necessary length to
	// facilitate IPv4 layer analysis should be chosen
	CaptureLengthMinimalIPv4Header = func(l *link.Link) int {
		return int(l.Type.IPHeaderOffset()) + ipv4.HeaderLen
	}

	// CaptureLengthMinimalIPv6Header indicates that the minimal necessary length to
	// facilitate IPv6 layer analysis should be chosen
	CaptureLengthMinimalIPv6Header = func(l *link.Link) int {
		return int(l.Type.IPHeaderOffset()) + ipv6.HeaderLen
	}

	// CaptureLengthMinimalIPv4Transport indicates that the minimal necessary length to
	// facilitate IPv4 transport layer analysis should be chosen
	CaptureLengthMinimalIPv4Transport = func(l *link.Link) int {
		return int(l.Type.IPHeaderOffset()) + ipv4.HeaderLen + 14
	}

	// CaptureLengthMinimalIPv6Transport indicates that the minimal necessary length to
	// facilitate IPv6 transport layer analysis should be chosen
	CaptureLengthMinimalIPv6Transport = func(l *link.Link) int {
		return int(l.Type.IPHeaderOffset()) + ipv6.HeaderLen + 14
	}
)
View Source
var BpfInstructionsNoLimit = func(snapLen int, ignoreVLANs bool, extraInstr ...bpf.RawInstruction) (res []bpf.RawInstruction) {
	if snapLen == 0 {
		snapLen = defaultSnapLen
	}
	nExtra := uint8(len(extraInstr))

	if ignoreVLANs {
		res = []bpf.RawInstruction{
			{Op: opLDW, Jt: 0x0, Jf: 0x0, K: regVLanT},
			{Op: opJEQ, Jt: 0x0, Jf: 0x1 + nExtra, K: 0x0},
		}
	}

	if nExtra > 0 {
		res = append(res, extraInstr...)
	}

	res = append(res, []bpf.RawInstruction{
		{Op: opRET, Jt: 0x0, Jf: 0x0, K: uint32(snapLen)},
		{Op: opRET, Jt: 0x0, Jf: 0x0, K: 0x0},
	}...)

	return
}

BpfInstructionsNoLimit provides a minimal BPF filter (no limitation except for snaplen, VLAN)

Functions

This section is empty.

Types

type BPFFn

type BPFFn func(int, bool, ...bpf.RawInstruction) []bpf.RawInstruction

BPFFn denotes a generic BPF wrapper function that is used to provide link type dependent filters

func BPFFilter

func BPFFilter(t link.Type) BPFFn

BPFFilter returns the link / interface specific raw BPF instructions to filter for valid packets only

type CaptureLengthStrategy

type CaptureLengthStrategy = func(l *link.Link) int

CaptureLengthStrategy denotes a strategy to calculate an optimal snaplen for a link (type) depending on the use case

type EtherType

type EtherType uint16

EtherType denotes the protocol encapsulated in the payload of the ethernet frame

const (

	// EtherTypeIPv4 denotes an IPv4 ethernet frame
	EtherTypeIPv4 EtherType = 0x0800

	// EtherTypeIPv6 denotes an IPv6 ethernet frame
	EtherTypeIPv6 EtherType = 0x86DD
)

func (EtherType) HasValidIPLayer

func (t EtherType) HasValidIPLayer() bool

HasValidIPLayer determines if the ethernet frame has a valid IPv4 or IPv6 layer

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL