README
¶
gtap
A lightweight command-line packet capture and analysis utility written in Go. Capture live network traffic, read pcap files, apply filters, and display data in multiple formats.
Table of Contents
Features
- Live packet capture from all or specific network interfaces
- BPF filtering to capture only relevant packets
- Pcap file support for reading and writing packet data
- Multiple output formats: summary view and hex dumps
- Promiscuous and monitor modes for advanced packet capture
- Cross Platform. Works on Linux, Windows and MacOS.
Requirements
- Go 1.18 or higher
- libpcap development headers:
- Debian/Ubuntu:
libpcap-dev - Fedora/CentOS:
libpcap-devel - macOS:
libpcap(via Homebrew) - Windows: npcap which can be obtained here.
- Debian/Ubuntu:
Installation
From Source
git clone https://github.com/kakeetopius/gtap.git
cd gtap
go build -o gtap .
#OR install to path on linux
sudo make install
OR install directly from github with Go. Make sure GOBIN is part of the shell's PATH.
go install github.com/kakeetopius/gtap@latest
Usage
gtap [OPTIONS]
[!NOTE] If no interface is specified, the user is presented with a list of available network interfaces on the system and prompted to select one.
Options
| Flag | Description |
|---|---|
-i |
Capture from specific interface (e.g., -i eth0) |
-f |
Apply BPF filter (e.g., -f "tcp port 80") |
-p |
Enable promiscuous mode |
-m |
Enable monitor mode |
--read |
Read packets from pcap file |
--write |
Save captured packets to pcap file |
--summary |
Display packet summary. |
--hex |
Display packet data as hex dump |
Examples
Capture all packets on the selected interface
gtap
Capture from eth0 in promiscuous mode and save to a pcap file:
gtap -i eth0 -p --write capture.pcap
Read and analyze a pcap file and output packets in summary form:
gtap --read capture.pcap --summary
Display a hex dump of captured packets:
gtap --read capture.pcap --hex
Capture only HTTP traffic:
gtap -f "tcp port 80" --summary
Capture HTTPS traffic from a specific interface:
gtap -i eth0 -f "tcp port 443" --write secure.pcap
Filters
BPF (Berkeley Packet Filter) syntax is supported. Common examples:
tcp port 80- HTTP trafficudp port 53- DNS queriesip src 192.168.1.1- Traffic from specific IPicmp- ICMP packets (ping)tcp and dst port 22- SSH traffic
License
MIT License. See LICENSE for details.
Powered by Google's gopacket
Documentation
¶
There is no documentation for this package.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
internal
|
|
|
argparser
Package argparser offers command line argument parsing utilities.
|
Package argparser offers command line argument parsing utilities. |
|
decoding
Package decoding is used to decode packet data and print fields within the packet.
|
Package decoding is used to decode packet data and print fields within the packet. |
|
pcap
Package pcap provides functions to interface with the gopacket/pcap library.
|
Package pcap provides functions to interface with the gopacket/pcap library. |
|
tui
Package tui contains some tui components.
|
Package tui contains some tui components. |
|
util
Package util provides different utilities utilised throught the project.
|
Package util provides different utilities utilised throught the project. |