# README
GoPacket
This library provides packet decoding capabilities for Go. See godoc for more details.
Minimum Go version required is 1.5 except for pcapgo/EthernetHandle, afpacket, and bsdbpf which need at least 1.9 due to x/sys/unix dependencies.
Originally forked from the gopcap project written by Andreas Krennmair [email protected] (http://github.com/akrennmair/gopcap).
# Packages
Package bytediff provides a simple diff utility for looking at differences in byte slices.
Package dumpcommand implements a run function for pfdump and pcapdump with many similar flags/features to tcpdump.
Package ip4defrag implements a IPv4 defragmenter.
Package layers provides decoding layers for many common protocols.
Package macs provides an in-memory mapping of all valid Ethernet MAC address prefixes to their associated organization.
Package pcap allows users of gopacket to read packets off the wire or from
pcap files.
Package pcapgo provides some native PCAP support, not requiring C libpcap to be installed.
Package pfring wraps the PF_RING C library for Go.
Package reassembly provides TCP stream re-assembly.
Package routing provides a very basic but mostly functional implementation of a routing table for IPv4/IPv6 addresses.
Package tcpassembly provides TCP stream re-assembly.
# Functions
ConcatFinitePacketDataSources returns a PacketDataSource that wraps a set of internal PacketDataSources, each of which will stop with io.EOF after reading a finite number of packets.
FlowFromEndpoints creates a new flow by pasting together two endpoints.
LayerDump outputs a very verbose string representation of a layer.
LayerGoString returns a representation of the layer in Go syntax, taking care to shorten "very long" BaseLayer byte slices.
LayersDecoder returns DecodingLayerFunc for specified DecodingLayerContainer, LayerType value to start decoding with and some DecodeFeedback.
LayerString outputs an individual layer as a string.
LongBytesGoString returns a string representation of the byte slice shortened using the format '<type>{<truncated slice> ..
NewDecodingLayerParser creates a new DecodingLayerParser and adds in all of the given DecodingLayers with AddDecodingLayer.
NewEndpoint creates a new Endpoint object.
NewFlow creates a new flow.
NewLayerClass creates a LayerClass, attempting to be smart about which type it creates based on which types are passed in.
NewLayerClassMap creates a LayerClassMap and sets map[t] to true for each type in types.
NewLayerClassSlice creates a new LayerClassSlice by creating a slice of size max(types) and setting slice[t] to true for each type t.
NewPacket creates a new Packet object from a set of bytes.
NewPacketSource creates a packet data source.
NewSerializeBuffer creates a new instance of the default implementation of the SerializeBuffer interface.
NewSerializeBufferExpectedSize creates a new buffer for serialization, optimized for an expected number of bytes prepended/appended.
OverrideLayerType acts like RegisterLayerType, except that if the layer type has already been registered, it overrides the metadata with the passed-in metadata intead of panicing.
RegisterEndpointType creates a new EndpointType and registers it globally.
RegisterLayerType creates a new layer type and registers it globally.
SerializeLayers clears the given write buffer, then writes all layers into it so they correctly wrap each other.
SerializePacket is a convenience function that calls SerializeLayers on packet's Layers().
# Constants
MaxEndpointSize determines the maximum size in bytes of an endpoint address.
# Variables
DecodeFragment is a Decoder that returns a Fragment layer containing all remaining bytes.
DecodePayload is a Decoder that returns a Payload layer containing all remaining bytes.
DecodersByLayerName maps layer names to decoders for those layers.
DecodeStreamsAsDatagrams is a DecodeOptions with just DecodeStreamsAsDatagrams set.
DecodeUnknown is a Decoder that returns an Unknown layer containing all remaining bytes, useful if you run up against a layer that you're unable to decode yet.
Default decoding provides the safest (but slowest) method for decoding packets.
EndpointInvalid is an endpoint type used for invalid endpoints, IE endpoints that are specified incorrectly during creation.
InvalidEndpoint is a singleton Endpoint of type EndpointInvalid.
InvalidFlow is a singleton Flow of type EndpointInvalid.
LayerTypeDecodeFailure is the layer type for the default error layer.
LayerTypeFragment is the layer type for a fragment of a layer transported by an underlying layer that supports fragmentation.
LayerTypePayload is the layer type for a payload that we don't try to decode but treat as a success, IE: an application-level payload.
LayerTypeZero is an invalid layer type, but can be used to determine whether layer type has actually been set correctly.
Lazy is a DecodeOptions with just Lazy set.
NilDecodeFeedback implements DecodeFeedback by doing nothing.
NoCopy is a DecodeOptions with just NoCopy set.
TimestampResolutionCaptureInfo is the resolution used in CaptureInfo, which his currently nanosecond.
TimestampResolutionInvalid represents an invalid timestamp resolution.
TimestampResolutionMicrosecond is a resolution of 10^-6s.
TimestampResolutionMillisecond is a resolution of 10^-3s.
TimestampResolutionNanosecond is a resolution of 10^-9s.
TimestampResolutionNTP is the resolution of NTP timestamps which is 2^-32 ≈ 233 picoseconds.
# Structs
CaptureInfo provides standardized information about a packet captured off the wire or read from a file.
DecodeFailure is a packet layer created if decoding of the packet data failed for some reason.
DecodeOptions tells gopacket how to decode a packet.
DecodingLayerParser parses a given set of layer types.
DecodingLayerParserOptions provides options to affect the behavior of a given DecodingLayerParser.
Endpoint is the set of bytes used to address packets at various layers.
EndpointTypeMetadata is used to register a new endpoint type.
Flow represents the direction of traffic for a packet layer, as a source and destination Endpoint.
LayerTypeMetadata contains metadata associated with each LayerType.
PacketMetadata contains metadata for a packet.
PacketSource reads in packets from a PacketDataSource, decodes them, and returns them.
SerializeOptions provides options for behaviors that SerializableLayers may want to implement.
TimestampResolution represents the resolution of timestamps in Base^Exponent.
# Interfaces
ApplicationLayer is the packet layer corresponding to the TCP/IP layer 4 (OSI layer 7), also known as the packet payload.
DecodeFeedback is used by DecodingLayer layers to provide decoding metadata.
Decoder is an interface for logic to decode a packet layer.
DecodingLayer is an interface for packet layers that can decode themselves.
DecodingLayerContainer stores all DecodingLayer-s and serves as a searching tool for DecodingLayerParser.
Dumper dumps verbose information on a value.
ErrorLayer is a packet layer created when decoding of the packet has failed.
Layer represents a single decoded packet layer (using either the OSI or TCP/IP definition of a layer).
LayerClass is a set of LayerTypes, used for grabbing one of a number of different types from a packet.
LinkLayer is the packet layer corresponding to TCP/IP layer 1 (OSI layer 2).
NetworkLayer is the packet layer corresponding to TCP/IP layer 2 (OSI layer 3).
Packet is the primary object used by gopacket.
PacketBuilder is used by layer decoders to store the layers they've decoded, and to defer future decoding via NextDecoder.
PacketDataSource is an interface for some source of packet data.
PacketSourceResolution is an interface for packet data sources that support reporting the timestamp resolution of the aqcuired timestamps.
SerializableLayer allows its implementations to be written out as a set of bytes, so those bytes may be sent on the wire or otherwise used by the caller.
SerializeBuffer is a helper used by gopacket for writing out packet layers.
TransportLayer is the packet layer corresponding to the TCP/IP layer 3 (OSI layer 4).
ZeroCopyPacketDataSource is an interface to pull packet data from sources that allow data to be returned without copying to a user-controlled buffer.
# Type aliases
DecodeFunc wraps a function to make it a Decoder.
DecodingLayerArray is an array-based implementation of DecodingLayerContainer.
DecodingLayerFunc decodes given packet and stores decoded LayerType values into specified slice.
DecodingLayerMap is an map-based implementation of DecodingLayerContainer.
DecodingLayerSparse is a sparse array-based implementation of DecodingLayerContainer.
EndpointType is the type of a gopacket Endpoint.
Fragment is a Layer containing a fragment of a larger frame, used by layers like IPv4 and IPv6 that allow for fragmentation of their payloads.
LayerClassMap implements a LayerClass with a map.
LayerClassSlice implements a LayerClass with a slice.
LayerType is a unique identifier for each type of layer.
Payload is a Layer containing the payload of a packet.
UnsupportedLayerType is returned by DecodingLayerParser if DecodeLayers encounters a layer type that the DecodingLayerParser has no decoder for.