Raw Socket Sniffing in Golang

networking go libpcap sniffing
Skineffect picture Skineffect · Jan 23, 2014 · Viewed 11.4k times · Source

I have a question concerning tcp packet sniffing with golang. We have written a small tool which captures all incoming TCP packets comming from a fibre Tap.

The current implementation uses a libpcap wrapper under Linux. We need to port this tool to Windows. Of course, it is not possible at the moment.

So my question is, is there a cross platform solution for sniffing packets? We only need TCP packets, IP headers , no Ethernet Data and not all features of libpcap.

If there is no cross platform solution, two Code implementation would be ok, too. I know one can use raw sockets under Linux (and with some limitations under Windows). Does Golang support raw sockets and is there an example implementation for sniffing packets with sockets?

Tanks!! :-)

Answer

Intermernet picture Intermernet · Jan 24, 2014

You should be able to use the ipv4 package from go.net.

Package ipv4 implements IP-level socket options for the Internet Protocol version 4.

The ipv4.RawConn type and it's associated methods should work cross-platform.

A RawConn represents a packet network endpoint that uses the IPv4 transport. It is used to control several IP-level socket options including IPv4 header manipulation. It also provides datagram based network I/O methods specific to the IPv4 and higher layer protocols that handle IPv4 datagram directly such as OSPF, GRE.

There is also an equivalent package for ipv6.

Related questions

Access HTTP response as string in Go

I'd like to parse the response of a web request, but I'm getting trouble accessing it as string. func main() { resp, err := http.Get("http://google.hu/") if err != nil { // handle error } defer resp.Body.Close() body, err := ioutil.ReadAll(…

Read More
Golang - check if IP address is in a network

Given: a network address A: (172.17.0.0/16) and an IP address from a host B: (172.17.0.2/16) how can we say if B is in A? All addresses are string variables in the following form: [IP address in dot-decimal notation]/[subnet mask]. Should I …

Read More
How do I stop a Listening server in Go

I've been trying to find a way to stop a listening server in Go gracefully. Because listen.Accept blocks it is necessary to close the listening socket to signal the end, but I can't tell that error apart from any …

Read More