Doing go get github.com/akrennmair/gopcap

gives

.gvm/pkgsets/go1.2.1/global/src/github.com/akrennmair/gopcap/pcap.go:12:18: fatal error: pcap.h: No such file or directory
 #include <pcap.h>

This is a slightly more involved change than the first few I've sent. It changes a packet's Headers from interface{} to a new Header interface. Currently, this interface just as a HeaderType() (enumerated in decode.go) and a Bytes() slice, which returns the bytes detected to be part of the header.

This allows for a couple of nice things. First, it makes switching based on header type easy (switch pkt.HeaderType() {}). Also, it opens up the ability to do cursory parsing of certain header types without fully coding them. If, for example, there's a header X that doesn't affect the ending payload, we can decode and skip it without fully coding the decode() function. I'm planning to do this next with IPv6 extensions, basically a quick initial implementation that does nothing but pulls out Bytes() and HeaderType(), and leaves the rest of the decoding for a later time.

If you improperly call the tcpdump tool, no error feedback is written to stdout. There is a missing flush call on the errout writer.

You will now get the friendly feedback: usage: ./tcpdump [ -i interface ] [ -s snaplen ] [ -X ] [ expression ]

hi can be add pppoe decode packet code? "code.google.com/p/gopacket/" see code is very difficult i can not understand because i need to thank you very much.

The C pcap library uses {sec,usec} for timestamps, where usec are microsconds. Go's time.Time have nanosecond precisions, so we need to convert between the two.

Speed up the copy of packet data from C into Go, using C.GoBytes. Also avoid a copy of the packet header struct. Together, this seems to reduce packet read speed by ~50%

Added a benchmark binary for testing this change.

Old: (/tmp/bench is tools/benchmark with the old code) [email protected]:/$ /tmp/bench -file /tmp/foo Took 3.334896s to process 1000000 packets, 3.334us per packet, 0 nil packets [email protected]:/$ /tmp/bench -file /tmp/foo Took 3.329675s to process 1000000 packets, 3.329us per packet, 0 nil packets

New: (/tmp/bench2 is tools/benchmark with the new code) [email protected]:/$ /tmp/bench2 -file /tmp/foo Took 1.588695s to process 1000000 packets, 1.588us per packet, 0 nil packets [email protected]:/$ /tmp/bench2 -file /tmp/foo Took 1.580306s to process 1000000 packets, 1.58us per packet, 0 nil packets

About a 50% reduction in the initial packet copy. This seemed to work pretty repeatably.

I've added some decoding for VLAN-tagged IPs. Note there's a couple of extraneous changes to io.go and pcap.go... these were done by 'go fmt', not by me.

Hello,

These commits remove a lot of code from gopcap and use the standard library a lot more. Esp the use of the encoding/binary instead of all the put4/put2, asUint16, etc.

I also seems to run somewhat faster. :)

This includes a simple test of packet.Decode, doing full testing against decoding a single IPv4 TCP packet. It also provides a second test specifically for a small TCP packet with ethernet padding, to make sure that change works correctly as well.

This solves the issue where Ethernet packets must be a minimum of 60 bytes, but can take up only 54 bytes on the wire if there's no payload added. Without this change, packets of that type may appear to be TCP packets with 6 null bytes in their payload.

See http://forums.devshed.com/networking-help-109/tcp-protocol-mysterious-6-null-byte-payload-303357.html for more discussion on this.

The Makefile is ignored by goinstall. This small change allows users of the wrapper to use goinstall to easily install the wrapper. See http://golang.org/cmd/goinstall/ for more information.

I got a problem of cross compiling program based on gopacket : the env of go is--------> GOARCH="mips" GOBIN="" GOEXE="" GOHOSTARCH="amd64" GOHOSTOS="linux" GOOS="linux" GOPATH="/root/go" GORACE="" GOROOT="/usr/local/go" GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64" GCCGO="gccgo" CC="mips-linux-gcc" GOGCCFLAGS="-fPIC -mabi=32 -march=mips32 -pthread -fmessage-length=0" CXX="mips-linux-g++" CGO_ENABLED="1" CGO_CFLAGS="-I/usr/include" CGO_CPPFLAGS="" CGO_CXXFLAGS="-g -O2" CGO_FFLAGS="-g -O2" CGO_LDFLAGS="-L/root/Desktop/libpcap-1.9.0" PKG_CONFIG="pkg-config"

the result of it is:

runtime/cgo

cc1: warnings being treated as errors In file included from gcc_libinit.c:8: /usr/include/pthread.h:675: Warning：‘regparm’ attribute directive ignored /usr/include/pthread.h:687: Warning：‘regparm’ attribute directive ignored /usr/include/pthread.h:732: Warning：‘regparm’ attribute directive ignored

I change the include path to "-I/root/Desktop/libpcap-1.9.0" ,the result is: loading DWARF type: decoding dwarf section info at offset 0x157: unexpected opcode

I have no idea about that.Can u help me?: )

With Go 1.12.5 on Fedora Rawhide x86_64, commit 00e11033259acb75598ba416495bb708d864a010:

Testing    in: /builddir/build/BUILD/gopcap-00e11033259acb75598ba416495bb708d864a010/_build/src
         PATH: /builddir/build/BUILD/gopcap-00e11033259acb75598ba416495bb708d864a010/_build/bin:/builddir/.local/bin:/builddir/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/sbin
       GOPATH: /builddir/build/BUILD/gopcap-00e11033259acb75598ba416495bb708d864a010/_build:/usr/share/gocode
  GO111MODULE: off
      command: go test -buildmode pie -compiler gc -ldflags "-X github.com/akrennmair/gopcap/version=0 -X github.com/akrennmair/gopcap/version.commit=00e11033259acb75598ba416495bb708d864a010 -extldflags '-Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld '"
      testing: github.com/akrennmair/gopcap
github.com/akrennmair/gopcap
# github.com/akrennmair/gopcap
./pcap.go:129:13: identifier "_Ctype_struct_pcap_stat" may conflict with identifiers generated by cgo
./pcap.go:142:10: identifier "_Ctype_struct_bpf_program" may conflict with identifiers generated by cgo
./pcap.go:216:34: identifier "_Ctype_struct_pcap_addr" may conflict with identifiers generated by cgo
./pcap.go:219:56: identifier "_Ctype_struct_pcap_addr" may conflict with identifiers generated by cgo
FAIL	github.com/akrennmair/gopcap [build failed]

I noticed https://github.com/google/gopacket, which says it was forked off this repo. Are there any advantages of using this repo versus https://github.com/google/gopacket?