Documentation
¶
Overview ¶
Package pcap implements a pure-Go libpcap classic-format writer and reader. It is deliberately minimal: no CGo, no gopacket, stdlib only. The output is compatible with Wireshark, aircrack-ng, and hashcat.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type LinkType ¶
type LinkType uint32
LinkType identifies the data-link encapsulation of frames in the pcap.
const ( // LinkTypeEthernet is IEEE 802.3 Ethernet. LinkTypeEthernet LinkType = 1 // LinkTypeIEEE802_11 is raw 802.11 without any prefix header. // This is what most Marauder packet dumps emit. LinkTypeIEEE802_11 LinkType = 105 // LinkTypeIEEE802_11Radiotap is 802.11 preceded by a radiotap header. // Preferred for hashcat / aircrack-ng because it carries channel and RSSI. LinkTypeIEEE802_11Radiotap LinkType = 127 )
type RadiotapHeader ¶
type RadiotapHeader struct {
// Channel is the centre frequency in MHz (e.g. 2412 for channel 1,
// 5180 for channel 36). Zero is treated as unknown / unset.
Channel uint16
// Flags is the radiotap Flags field (bit 1 in the present bitmap).
// 0x10 signals that an FCS is appended to the frame payload.
Flags uint8
// SignalDBM is the receive signal strength in dBm (e.g. -65).
// Zero means unknown.
SignalDBM int8
// Rate is the data rate in units of 500 kbps (e.g. 2 = 1 Mbit/s).
// Zero means unknown.
Rate uint8
}
RadiotapHeader is a minimal radiotap prefix for 802.11 frames. Prepend the result of Bytes() before the raw 802.11 frame when writing with LinkTypeIEEE802_11Radiotap.
func (RadiotapHeader) Bytes ¶
func (h RadiotapHeader) Bytes() []byte
Bytes returns the 16-byte radiotap-encoded prefix to prepend to a bare 802.11 frame before handing it to Writer.WritePacket when the Writer was created with LinkTypeIEEE802_11Radiotap.
type Reader ¶
type Reader struct {
// contains filtered or unexported fields
}
Reader reads a libpcap classic file emitted by Writer. It supports both little-endian (magic 0xa1b2c3d4) and big-endian (magic 0xd4c3b2a1) files, though Writer only produces little-endian.
func NewReader ¶
NewReader reads and validates the 24-byte global pcap header from r. Returns an error if the magic is unrecognised or the version is not 2.4.
type Writer ¶
type Writer struct {
// contains filtered or unexported fields
}
Writer streams packets to an io.Writer in libpcap classic format.
Concurrency: not safe for concurrent WritePacket; serialise externally.
Usage:
w, err := pcap.NewWriter(file, pcap.LinkTypeIEEE802_11Radiotap)
if err != nil { ... }
w.WritePacket(time.Now(), frameBytes)
// closing the underlying file is the caller's responsibility
func NewWriter ¶
NewWriter writes the 24-byte global header to w and returns a Writer ready for WritePacket calls. Returns an error if the global header cannot be written.
func (*Writer) BytesWritten ¶
BytesWritten returns the total bytes written, including the global header and all per-packet record headers.
func (*Writer) PacketsWritten ¶
PacketsWritten returns the count of successful WritePacket calls.
func (*Writer) WritePacket ¶
WritePacket appends one packet record. ts is the capture timestamp; data is the raw frame bytes (already including any radiotap header when the Writer was created with LinkTypeIEEE802_11Radiotap).
If data is nil an error is returned and no bytes are written. If a previous write already failed, WritePacket attempts the write anyway (no poison-pill behaviour).
Source Files