Documentation
¶
Overview ¶
Package pcap implements a pure-Go libpcap classic-format writer and reader. It is deliberately minimal: no CGo, no gopacket, stdlib only. The output is compatible with Wireshark, aircrack-ng, and hashcat.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func LinkTypeName ¶ added in v0.286.0
LinkTypeName returns the canonical libpcap LINKTYPE_* name for the given network field. Returns a generated placeholder for unknown values rather than erroring — the operator can still see the raw number.
Types ¶
type InspectOpts ¶ added in v0.286.0
type InspectOpts struct {
// MaxRecords caps the number of per-record summaries
// returned. RecordCount + TotalRecordBytes still reflect
// the full file walk. Zero means no cap.
MaxRecords int
// MaxPayloadBytes caps the per-record PayloadHex preview.
// Zero means no preview (just header fields).
MaxPayloadBytes int
}
InspectOpts tunes the walker for output size.
func DefaultInspectOpts ¶ added in v0.286.0
func DefaultInspectOpts() InspectOpts
DefaultInspectOpts returns sensible caps so that large pcaps produce bounded output: first 50 records, 32-byte hex preview per record.
type LinkType ¶
type LinkType uint32
LinkType identifies the data-link encapsulation of frames in the pcap.
const ( // LinkTypeEthernet is IEEE 802.3 Ethernet. LinkTypeEthernet LinkType = 1 // LinkTypeIEEE802_11 is raw 802.11 without any prefix header. // This is what most Marauder packet dumps emit. LinkTypeIEEE802_11 LinkType = 105 // LinkTypeIEEE802_11Radiotap is 802.11 preceded by a radiotap header. // Preferred for hashcat / aircrack-ng because it carries channel and RSSI. LinkTypeIEEE802_11Radiotap LinkType = 127 )
type RadiotapHeader ¶
type RadiotapHeader struct {
// Channel is the centre frequency in MHz (e.g. 2412 for channel 1,
// 5180 for channel 36). Zero is treated as unknown / unset.
Channel uint16
// Flags is the radiotap Flags field (bit 1 in the present bitmap).
// 0x10 signals that an FCS is appended to the frame payload.
Flags uint8
// SignalDBM is the receive signal strength in dBm (e.g. -65).
// Zero means unknown.
SignalDBM int8
// Rate is the data rate in units of 500 kbps (e.g. 2 = 1 Mbit/s).
// Zero means unknown.
Rate uint8
}
RadiotapHeader is a minimal radiotap prefix for 802.11 frames. Prepend the result of Bytes() before the raw 802.11 frame when writing with LinkTypeIEEE802_11Radiotap.
func (RadiotapHeader) Bytes ¶
func (h RadiotapHeader) Bytes() []byte
Bytes returns the 16-byte radiotap-encoded prefix to prepend to a bare 802.11 frame before handing it to Writer.WritePacket when the Writer was created with LinkTypeIEEE802_11Radiotap.
type Reader ¶
type Reader struct {
// contains filtered or unexported fields
}
Reader reads a libpcap classic file emitted by Writer. It supports both little-endian (magic 0xa1b2c3d4) and big-endian (magic 0xd4c3b2a1) files, though Writer only produces little-endian.
func NewReader ¶
NewReader reads and validates the 24-byte global pcap header from r. Returns an error if the magic is unrecognised or the version is not 2.4.
type RecordSummary ¶ added in v0.286.0
type RecordSummary struct {
Index int `json:"index"`
TimestampSeconds uint32 `json:"timestamp_seconds"`
TimestampFraction uint32 `json:"timestamp_fraction"`
TimestampISO string `json:"timestamp_iso"`
CapturedLength uint32 `json:"captured_length"`
OriginalLength uint32 `json:"original_length"`
Truncated bool `json:"truncated,omitempty"`
PayloadHex string `json:"payload_hex,omitempty"`
PayloadBytesShown int `json:"payload_bytes_shown,omitempty"`
}
RecordSummary is the structured view of one per-packet record inside a libpcap file.
type Summary ¶ added in v0.286.0
type Summary struct {
MagicHex string `json:"magic_hex"`
Endianness string `json:"endianness"`
TimestampResolution string `json:"timestamp_resolution"`
VersionMajor int `json:"version_major"`
VersionMinor int `json:"version_minor"`
ThisZone int32 `json:"this_zone"`
SigFigs uint32 `json:"sig_figs"`
SnapLength uint32 `json:"snap_length"`
Network uint32 `json:"network"`
NetworkName string `json:"network_name"`
RecordCount int `json:"record_count"`
RecordsParsedHex int `json:"records_parsed_in_hex_preview"`
TotalRecordBytes uint64 `json:"total_record_bytes"`
FirstTimestamp string `json:"first_timestamp,omitempty"`
LastTimestamp string `json:"last_timestamp,omitempty"`
DurationSeconds float64 `json:"duration_seconds,omitempty"`
Records []RecordSummary `json:"records,omitempty"`
Notes []string `json:"notes,omitempty"`
}
Summary is the top-level structured view of a libpcap file.
func Inspect ¶ added in v0.286.0
func Inspect(b []byte, opts InspectOpts) (*Summary, error)
Inspect walks a libpcap file from its raw bytes and returns a Summary. Errors are returned only for unrecoverable framing issues (magic / version / truncated record header); partial payload tails are flagged via the Notes field rather than rejected, so that operators can still see what the capture claims to contain.
type Writer ¶
type Writer struct {
// contains filtered or unexported fields
}
Writer streams packets to an io.Writer in libpcap classic format.
Concurrency: not safe for concurrent WritePacket; serialise externally.
Usage:
w, err := pcap.NewWriter(file, pcap.LinkTypeIEEE802_11Radiotap)
if err != nil { ... }
w.WritePacket(time.Now(), frameBytes)
// closing the underlying file is the caller's responsibility
func NewWriter ¶
NewWriter writes the 24-byte global header to w and returns a Writer ready for WritePacket calls. Returns an error if the global header cannot be written.
func (*Writer) BytesWritten ¶
BytesWritten returns the total bytes written, including the global header and all per-packet record headers.
func (*Writer) PacketsWritten ¶
PacketsWritten returns the count of successful WritePacket calls.
func (*Writer) WritePacket ¶
WritePacket appends one packet record. ts is the capture timestamp; data is the raw frame bytes (already including any radiotap header when the Writer was created with LinkTypeIEEE802_11Radiotap).
If data is nil an error is returned and no bytes are written. If a previous write already failed, WritePacket attempts the write anyway (no poison-pill behaviour).
Source Files