Documentation
¶
Index ¶
Constants ¶
const ( DirClientToServer byte = 0x00 DirServerToClient byte = 0x01 )
Packet direction constants.
const ( ProtocolOracle = "oracle" ProtocolPostgreSQL = "postgresql" ProtocolMySQL = "mysql" ProtocolMongo = "mongodb" )
Protocol identifiers.
const FileExt = ".pcapng"
FileExt is the extension used for session capture files. Captures are plain pcapng, readable by tcpdump/Wireshark/tshark without any dbbat tooling.
Variables ¶
var ErrMissingMetadata = errors.New("capture has no dbbat session metadata")
ErrMissingMetadata is returned when a capture carries no dbbat session metadata in its Section Header Block comment.
Functions ¶
func Anonymise ¶
Anonymise reads a capture and writes an anonymised copy.
Packet payloads and their relative timing are preserved verbatim. The session metadata carried in the pcapng Section Header Block comment is reduced to the session ID and the protocol: the connection object (database, user, service name, upstream address…) is dropped, and the capture is rebased onto the Unix epoch so the wall-clock time of the session leaks nothing.
When rewriteAddresses is true — the default for the CLI — the synthesized IPv4 addresses and TCP ports are re-generated from the fake endpoints too, since the capture's server-side addressing normally encodes the real upstream host and port. Pass false to keep the original addressing.
func CleanupOldFiles ¶
CleanupOldFiles deletes .pcapng capture files older than the retention period. It also reaps leftover legacyFileExt files from before the pcapng switch, since they are otherwise unreadable and invisible to this sweep. Returns the number of files deleted.
Types ¶
type Header ¶
type Header struct {
SessionID string `json:"session_id"`
Protocol string `json:"protocol"`
StartTime time.Time `json:"start_time"`
Connection map[string]any `json:"connection"`
}
Header holds the JSON-serializable session metadata. It is stored as a JSON blob in the pcapng Section Header Block comment (opt_comment).
type Packet ¶
type Packet struct {
RelativeNs int64 // Nanoseconds since session start
Direction byte // DirClientToServer or DirServerToClient
Data []byte // Raw protocol bytes (TCP payload, synthesized headers stripped)
}
Packet represents a single captured application-layer payload.
type Reader ¶
type Reader struct {
// contains filtered or unexported fields
}
Reader reads application payloads back out of a pcapng capture, undoing the synthesized Ethernet/IPv4/TCP wrapping applied by Writer.
func OpenReader ¶
OpenReader opens a capture file and parses the session metadata carried in the pcapng Section Header Block comment.
func (*Reader) ReadPacket ¶
ReadPacket returns the next application payload. Frames without a TCP payload are skipped. Returns io.EOF at the end of the capture.
type TapConn ¶
TapConn wraps a net.Conn and captures all read/written bytes to a Writer. Reads are tagged with one direction, writes with the other.
func NewTapConn ¶
NewTapConn creates a connection wrapper that captures traffic to a dump Writer.
type Writer ¶
type Writer struct {
// contains filtered or unexported fields
}
Writer writes a session capture as a pcapng file. Application payloads are wrapped in synthesized Ethernet/IPv4/TCP headers (see synth.go) and the session metadata is stored as a JSON blob in the Section Header Block comment.
func NewWriter ¶
NewWriter creates a new capture file and writes the pcapng section header (carrying the session metadata) and interface description.
Source Files