NewReader returns a new Reader that decodes pcap data from r.
(r io.Reader)
| 55 | |
| 56 | // NewReader returns a new Reader that decodes pcap data from r. |
| 57 | func NewReader(r io.Reader) (*Reader, error) { |
| 58 | ret := &Reader{ |
| 59 | r: bufio.NewReader(r), |
| 60 | order: binary.LittleEndian, |
| 61 | } |
| 62 | |
| 63 | header := struct { |
| 64 | Magic uint32 |
| 65 | Major uint16 |
| 66 | Minor uint16 |
| 67 | // Timezone correction and time accuracy - both 0 in practice. |
| 68 | Ignored uint64 |
| 69 | Snaplen uint32 |
| 70 | Type uint32 |
| 71 | }{} |
| 72 | |
| 73 | bs := make([]byte, binary.Size(header)) |
| 74 | if _, err := io.ReadFull(ret.r, bs); err != nil { |
| 75 | return nil, fmt.Errorf("reading pcap header: %s", err) |
| 76 | } |
| 77 | |
| 78 | // Annoyingly, the header encodings are defined in terms of "same" |
| 79 | // or "opposite" endian, rather than in absolute terms, so reading |
| 80 | // the magic alone (as is intended) doesn't let us figure out what |
| 81 | // endianness to use. However, we can cheat and look at the |
| 82 | // major/minor version numbers instead. Try little-endian first, |
| 83 | // since that's more common these days. |
| 84 | if err := binary.Read(bytes.NewBuffer(bs), ret.order, &header); err != nil { |
| 85 | return nil, err |
| 86 | } |
| 87 | if header.Major == 0x200 && header.Minor == 0x400 { |
| 88 | // Byte order was wrong, read again |
| 89 | ret.order = binary.BigEndian |
| 90 | if err := binary.Read(bytes.NewBuffer(bs), ret.order, &header); err != nil { |
| 91 | return nil, err |
| 92 | } |
| 93 | } |
| 94 | switch header.Magic { |
| 95 | case 0xa1b2c3d4: |
| 96 | // Timestamps are (sec, usec) |
| 97 | ret.tmult = 1000 |
| 98 | case 0xa1b23c4d: |
| 99 | // Timestamps are (sec, nsec) |
| 100 | ret.tmult = 1 |
| 101 | default: |
| 102 | return nil, errors.New("bad magic") |
| 103 | } |
| 104 | |
| 105 | if header.Major != 2 || header.Minor != 4 { |
| 106 | return nil, fmt.Errorf("Unknown pcap version %d.%d", header.Major, header.Minor) |
| 107 | } |
| 108 | |
| 109 | ret.LinkType = LinkType(header.Type) |
| 110 | |
| 111 | return ret, nil |
| 112 | } |
| 113 | |
| 114 | // Packet returns the packet read by the last call to Next. |