Golang Packet.ErrorLayer方法代碼示例

//------ PCAP Print PCAP Data -----
func process_gopacket(packet gopacket.Packet) {

	// Let's see if the packet is IP (even though the ether type told us)
	ipLayer := packet.Layer(layers.LayerTypeIPv4)
	if ipLayer != nil {
		ip, _ := ipLayer.(*layers.IPv4)

		register_network_call_with_redis(ip.Protocol, ip.DstIP)
	}

	// Check for errors
	if err := packet.ErrorLayer(); err != nil {
		fmt.Println("Error decoding some part of the packet:", err)
	}
}

func printPacketInfo(packet gopacket.Packet) {
	applicationLayer := packet.ApplicationLayer()
	if applicationLayer != nil {
		buff := []byte(applicationLayer.Payload())
		p := rfc3164.NewParser(buff)
		err := p.Parse()
		if err != nil {
			fmt.Println("Error decoding Payload:", err)
		}
		fmt.Printf("%s", p.Dump()["content"])
	}

	if err := packet.ErrorLayer(); err != nil {
		fmt.Println("Error decoding some part of the packet:", err)
	}
}

func printPacketInfo(packet gopacket.Packet) {
	// Let's see if the packet is an ethernet packet
	ethernetLayer := packet.Layer(layers.LayerTypeEthernet)
	if ethernetLayer != nil {
		fmt.Println("Ethernet layer detected.")
		ethernetPacket, _ := ethernetLayer.(*layers.Ethernet)
		fmt.Println("Source MAC: ", ethernetPacket.SrcMAC)
		fmt.Println("Destination MAC: ", ethernetPacket.DstMAC)
		// Ethernet type is typically IPv4 but could be ARP or other
		fmt.Println("Ethernet type: ", ethernetPacket.EthernetType)
		fmt.Println()
	}

	// Let's see if the packet is IP (even though the ether type told us)
	ipLayer := packet.Layer(layers.LayerTypeIPv4)
	if ipLayer != nil {
		fmt.Println("IPv4 layer detected.")
		ip, _ := ipLayer.(*layers.IPv4)

		// IP layer variables:
		// Version (Either 4 or 6)
		// IHL (IP Header Length in 32-bit words)
		// TOS, Length, Id, Flags, FragOffset, TTL, Protocol (TCP?),
		// Checksum, SrcIP, DstIP
		fmt.Printf("From %s to %s\n", ip.SrcIP, ip.DstIP)
		fmt.Println("Protocol: ", ip.Protocol)
		fmt.Println()
	}

	// Let's see if the packet is TCP
	tcpLayer := packet.Layer(layers.LayerTypeTCP)
	if tcpLayer != nil {
		fmt.Println("TCP layer detected.")
		tcp, _ := tcpLayer.(*layers.TCP)

		// TCP layer variables:
		// SrcPort, DstPort, Seq, Ack, DataOffset, Window, Checksum, Urgent
		// Bool flags: FIN, SYN, RST, PSH, ACK, URG, ECE, CWR, NS
		fmt.Printf("From port %d to %d\n", tcp.SrcPort, tcp.DstPort)
		fmt.Println("Sequence number: ", tcp.Seq)
		fmt.Println()
	}

	// Iterate over all layers, printing out each layer type
	fmt.Println("All packet layers:")
	for _, layer := range packet.Layers() {
		fmt.Println("- ", layer.LayerType())
	}

	// When iterating through packet.Layers() above,
	// if it lists Payload layer then that is the same as
	// this applicationLayer. applicationLayer contains the payload
	applicationLayer := packet.ApplicationLayer()
	if applicationLayer != nil {
		fmt.Println("Application layer/Payload found.")
		fmt.Printf("%s\n", applicationLayer.Payload())

		// Search for a string inside the payload
		if strings.Contains(string(applicationLayer.Payload()), "HTTP") {
			fmt.Println("HTTP found!")
		}
	}

	// Check for errors
	if err := packet.ErrorLayer(); err != nil {
		fmt.Println("Error decoding some part of the packet:", err)
	}
}

//.........這裏部分代碼省略.........
		event["ethernet_src_mac"] = fmt.Sprintf("%v", ethernetPacket.SrcMAC)
		event["ethernet_dst_mac"] = fmt.Sprintf("%v", ethernetPacket.DstMAC)
		// ethernet type is typically IPv4 but could be ARP or other
		event["ethernet_type"] = fmt.Sprintf("%v", ethernetPacket.EthernetType)
		// Length is only set if a length field exists within this header.  Ethernet
		// headers follow two different standards, one that uses an EthernetType, the
		// other which defines a length the follows with a LLC header (802.3).  If the
		// former is the case, we set EthernetType and Length stays 0.  In the latter
		// case, we set Length and EthernetType = EthernetTypeLLC.
		event["ethernet_length"] = fmt.Sprintf("%v", ethernetPacket.Length)
	}

	// IPv4 layer?
	ipLayer := packet.Layer(layers.LayerTypeIPv4)
	if ipLayer != nil {
		ip, _ := ipLayer.(*layers.IPv4)
		event["ip_version"] = ip.Version
		event["ip_ihl"] = ip.IHL
		event["ip_tos"] = ip.TOS
		event["ip_length"] = ip.Length
		event["ip_id"] = ip.Id
		event["ip_flags"] = ip.Flags
		event["ip_fragoffset"] = ip.FragOffset
		event["ip_ttl"] = ip.TTL
		event["ip_protocol"] = ip.Protocol
		event["ip_checksum"] = ip.Checksum
		event["ip_src_ip"] = ip.SrcIP
		event["ip_dst_ip"] = ip.DstIP
		event["ip_options"] = ip.Options // maybe? fmt.Sprintf("%v", ip.Options)
		event["ip_padding"] = ip.Padding
	}

	// IPv6 layer?
	ip6Layer := packet.Layer(layers.LayerTypeIPv6)
	if ip6Layer != nil {
		ip6, _ := ip6Layer.(*layers.IPv6)
		event["ip6_version"] = ip6.Version
		event["ip6_trafficclass"] = ip6.TrafficClass
		event["ip6_flowlabel"] = ip6.FlowLabel
		event["ip6_length"] = ip6.Length
		event["ip6_nextheader"] = ip6.NextHeader
		event["ip6_hoplimit"] = ip6.HopLimit
		event["ip6_src_ip"] = ip6.SrcIP
		event["ip6_dst_ip"] = ip6.DstIP
		event["ip6_hopbyhop"] = ip6.HopByHop
	}

	// see: gopacket/layers folder ... what layers are needed for Snort/Suricata alerts?
	// ICMPv4 layer?
	// ICMPv6 layer?
	// ARP layer?

	// UDP layer?
	udpLayer := packet.Layer(layers.LayerTypeUDP)
	if udpLayer != nil {
		udp, _ := udpLayer.(*layers.UDP)
		event["udp_src_port"] = udp.SrcPort
		event["udp_dst_port"] = udp.DstPort
		event["udp_length"] = udp.Length
		event["udp_checksum"] = udp.Checksum
	}

	// TCP layer?
	tcpLayer := packet.Layer(layers.LayerTypeTCP)
	if tcpLayer != nil {
		tcp, _ := tcpLayer.(*layers.TCP)
		event["tcp_src_port"] = tcp.SrcPort
		event["tcp_dst_port"] = tcp.DstPort
		event["tcp_seq"] = tcp.Seq
		event["tcp_ack"] = tcp.Ack
		event["tcp_data_offset"] = tcp.DataOffset
		event["tcp_fin"] = tcp.FIN
		event["tcp_syn"] = tcp.SYN
		event["tcp_rst"] = tcp.RST
		event["tcp_psh"] = tcp.PSH
		event["tcp_ack"] = tcp.ACK
		event["tcp_urg"] = tcp.URG
		event["tcp_ece"] = tcp.ECE
		event["tcp_cwr"] = tcp.CWR
		event["tcp_ns"] = tcp.NS
		event["tcp_window"] = tcp.Window
		event["tcp_checksum"] = tcp.Checksum
		event["tcp_urgent"] = tcp.Urgent
		event["tcp_options"] = tcp.Options // maybe? fmt.Sprintf("%v", tcp.Options)
		event["tcp_padding"] = tcp.Padding
	}

	// note: the Payload layer is the same as this applicationLayer
	// also, we can get payloads for all packets regardless of their underlying data type:
	// application layer? (aka packet payload)
	applicationLayer := packet.ApplicationLayer()
	if applicationLayer != nil {
		event["packet_payload"] = fmt.Sprintf("%s", applicationLayer.Payload())
	}

	// errors?
	if err := packet.ErrorLayer(); err != nil {
		event["packet_error"] = fmt.Sprintf("Packet decoding error: %v", err)
	}
}

//------ PCAP Print PCAP Data -----
func process_gopacket(packet gopacket.Packet) {

	ethernetLayer := packet.Layer(layers.LayerTypeEthernet)
	if ethernetLayer != nil {
		ethernetPacket, _ := ethernetLayer.(*layers.Ethernet)
		fmt.Printf("Ethernet layer | Type: %s | Src_MAC: %s Dst_MAC: %s\n", ethernetPacket.EthernetType, ethernetPacket.SrcMAC, ethernetPacket.DstMAC)
		// Ethernet type is typically IPv4 but could be ARP or other
	}

	// Let's see if the packet is IP (even though the ether type told us)
	ipLayer := packet.Layer(layers.LayerTypeIPv4)
	if ipLayer != nil {
		ip, _ := ipLayer.(*layers.IPv4)
		// fmt.Printf("\tIPv4 | %s | Src: %s Dest: %s \n", ip.Protocol, ip.SrcIP, ip.DstIP)

		// IP layer variables:
		// Version (Either 4 or 6)
		// IHL (IP Header Length in 32-bit words)
		// TOS, Length, Id, Flags, FragOffset, TTL, Protocol (TCP?),
		// Checksum, SrcIP, DstIP

		//
		register_network_call_with_redis(ip.Protocol, ip.SrcIP, ip.DstIP)
	}

	// Let's see if the packet is TCP
	tcpLayer := packet.Layer(layers.LayerTypeTCP)
	if tcpLayer != nil {
		tcp, _ := tcpLayer.(*layers.TCP)
		fmt.Printf("\tTCP | From port %d to %d", tcp.SrcPort, tcp.DstPort)
		fmt.Println("| TCP Seq: ", tcp.Seq)

		// TCP layer variables:
		// SrcPort, DstPort, Seq, Ack, DataOffset, Window, Checksum, Urgent
		// Bool flags: FIN, SYN, RST, PSH, ACK, URG, ECE, CWR, NS
	}

	// dnsLayer := packet.Layer(layers.LayerTypeDNS)
	// if dnsLayer != nil {
	// 	dns, _ := dnsLayer.(*layers.DNS)
	// 	fmt.Println(dns)
	// }

	// // Iterate over all layers, printing out each layer type
	// fmt.Println("All packet layers:")
	// for _, layer := range packet.Layers() {
	// 	fmt.Println("- ", layer.LayerType())
	// }

	// When iterating through packet.Layers() above,
	// if it lists Payload layer then that is the same as
	// this applicationLayer. applicationLayer contains the payload
	// applicationLayer := packet.ApplicationLayer()
	// if applicationLayer != nil {
	// 	fmt.Println("Application layer/Payload found.")
	// 	fmt.Printf("%s\n", applicationLayer.Payload())

	// 	// Search for a string inside the payload
	// 	if strings.Contains(string(applicationLayer.Payload()), "HTTP") {
	// 		fmt.Println("HTTP found!")
	// 	}
	// }

	// Check for errors
	if err := packet.ErrorLayer(); err != nil {
		fmt.Println("Error decoding some part of the packet:", err)
	}
}