Function CaptureInterface

networkcapture.go:61–119

CaptureInterface dump all packet on specified network interface

(iface *net.Interface, devices *[]pcap.Interface, bpffilter string, f *os.File, verbose bool)

// CaptureInterface dump all packet on specified network interface
func CaptureInterface(iface *net.Interface, devices *[]pcap.Interface, bpffilter string, f *os.File, verbose bool) error {
	// We just look for IPv4 addresses, so try to find if the interface has one.
	var addr *net.IPNet
	addrs, err := iface.Addrs()
	if err != nil {
		return err
	}

	for _, a := range addrs {
		if ipnet, ok := a.(*net.IPNet); ok {
			if ip4 := ipnet.IP.To4(); ip4 != nil {
				addr = &net.IPNet{
					IP:   ip4,
					Mask: ipnet.Mask[len(ipnet.Mask)-4:],
				}
				break
			}
		}
	}

	fmt.Printf("[INFO] Using network range %v for interface \"%v\"", addr, iface.Name)

	// Try to find a match between device and interface
	var deviceName string
	for _, d := range *devices {
		if strings.Contains(fmt.Sprint(d.Addresses), fmt.Sprint(addr.IP)) {
			deviceName = d.Name
		}
	}

	if deviceName == "" {
		return fmt.Errorf("Cannot find the corresponding device for the interface \"%v\"", iface.Name)
	}

	// Open up a pcap handle for packet reads/writes.
	handle, err := pcap.OpenLive(deviceName, 65536, true, pcap.BlockForever)
	if err != nil {
		return err
	}
	defer handle.Close()

	// BPF filter
	if len(bpffilter) > 0 {
		if err = handle.SetBPFFilter(bpffilter); err != nil {
			return fmt.Errorf("BPF filter error: %s", err.Error())
		}
	}

	// Starting capture
	w := pcapgo.NewWriter(f)
	w.WriteFileHeader(65536, layers.LinkTypeEthernet)

	packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
	for packet := range packetSource.Packets() {
		w.WritePacket(packet.Metadata().CaptureInfo, packet.Data())
	}

	return nil