What steps will reproduce the problem?
1.  Using Windows 7, attempt to build layers subpackage or use in command

What is the expected output? What do you see instead?
The build fails since the below constants used in enums.go are not defined 
under windows.  

ProtocolFamilyIPv4        ProtocolFamily = C.PF_INET
ProtocolFamilyIPv6BSD     ProtocolFamily = 24
ProtocolFamilyIPv6FreeBSD ProtocolFamily = 28
ProtocolFamilyIPv6Darwin  ProtocolFamily = 30
ProtocolFamilyIPv6Linux   ProtocolFamily = 10

These constants are defined in socket_h.go for non-windows OS (see directive on 
line 7: +build linux,cgo darwin,cgo).

What version of the product are you using? On what operating system?
Go 1.1.1, Windows 7 64-bit

Please provide any additional information below.
I worked around the issue by creating a new file that defined these constants 
under windows (attached).  Not sure if this is the optimal solution.  

Thank you very much for this package - highly useful!

Hello. I implemented a native go pcap reader, parallel to the existing native 
go writer.

It supports 2.4 file format and decodes little and big endian.

GIT URL is https://code.google.com/r/damjancvetko-pcapgo-read-gopacket/

(sorry, did not find other way to submit pull request)

What steps will reproduce the problem?
1. Setup gopacket on Windows
2. Install WinPcap developer package 4.1.2
3. patch #13
4. build a golang program

What is the expected output? What do you see instead?
{{{
# code.google.com/p/gopacket/pcap
38: error: 'PCAP_NETMASK_UNKNOWN' undeclared (first use in this function)
}}}

What version of the product are you using? On what operating system?
`go get code.google.com/p/gopacket`
on go1.2.2.windows-amd64.msi, cygwin x86_64-w64-mingw32

Please provide any additional information below.

PCAP_NETMASK_UNKNOWN is not defined in old pcap.h. In winpcap, pcap.h does not 
have PCAP_NETMASK_UNKNOWN. That #define is referenced in (p *Handle) 
SetBPFFilter(expr string) (err error)

AFAIK arpscan.go:writeARP() leaks a running goroutine while iterating over the 
result of ips() and returning due to an error condition. See 

https://code.google.com/p/gopacket/source/browse/examples/arpscan/arpscan.go#149

gopacket/pcap is missing a few useful functions from the pcap C API. This is 
one of them.

Patch available on a branch at 
https://code.google.com/r/matthiasradestock-gopacket-pcap/source/list?name=pcap_
set_buffer_size

Attached patch provides support for pcap_offline_filter().

The API is little hideous due to the fact that the packet header and buffer is 
tied to the handle and we can therefor only refer to the packet data that is 
currently buffered in the pcap-handle struct. However I find it of great use to 
define a set a filters and quickly apply them to a received packet without 
having to do inspection using gocode.

in layers/tcpip.go

  func tcpipChecksum(data []byte, csum uint32) uint16 {
     ....

     if len(data)%2 == 1 {
    csum += uint32(data[length] << 8)
     }

     ....

It should be 

    csum += uint32(data[length]) << 8

Because a byte shift 8bits is 0.
I found this bug when my packet can't pass windows tcp/ip stack.
and wireshark found checksum invalid.

in file `c.pkt`. the correct checksum is a73a. before modify code is b13a.

WritePacketData makes a copy of the data with C.CString(string(data)), which is 
expensive and wholly unnecessary.

Patch to fix that is on a branch at 
https://code.google.com/r/matthiasradestock-gopacket-pcap/source/list?name=pcap_
zero_copy_write_packet_data

What steps will reproduce the problem?
1. Create a sample program using pcap and handle packets for layers

It does not compile because of missing function sockaddr_to_IP.

What is the expected output? What do you see instead?

sockaddr_to_IP needs to be defined in the source or imported

What version of the product are you using? On what operating system?

checked out today (02/02/2013) linux 64 bit

Please provide any additional information below.

It is used but not defined somewhere.

./pcap/pcap.go:     if a.IP, err = 
sockaddr_to_IP((*syscall.RawSockaddr)(unsafe.Pointer(curaddr.addr))); err != 
nil {
./pcap/pcap.go:     if a.Netmask, err = 
sockaddr_to_IP((*syscall.RawSockaddr)(unsafe.Pointer(curaddr.addr))); err != 
nil {

Does lead to compilation error.

diff --git a/layers/ip6.go b/layers/ip6.go
index 3f521fc..32ff67f 100644
--- a/layers/ip6.go
+++ b/layers/ip6.go
@@ -197,6 +197,14 @@ func decodeIPv6HeaderTLVOption(data []byte) (h 
ipv6HeaderTLVOption) {
        return
 }

+func (h ipv6HeaderTLVOption) Data() []byte {
+       data := make([]byte, int(h.OptionLength) + 2)
+       data[0] = h.OptionType
+       data[1] = h.OptionLength
+       copy(data[2:], h.OptionData)
+       return data
+}
+
 // IPv6HopByHopOption is a TLV option present in an IPv6 hop-by-hop extension.
 type IPv6HopByHopOption ipv6HeaderTLVOption

@@ -341,3 +349,21 @@ func decodeIPv6Destination(data []byte, p 
gopacket.PacketBuilder) error {
        p.AddLayer(i)
        return p.NextDecoder(i.NextHeader)
 }
+
+// SerializeTo writes the serialized form of this layer into the
+// SerializationBuffer, implementing gopacket.SerializableLayer.
+// See the docs for gopacket.SerializableLayer for more info.
+func (i *IPv6Destination) SerializeTo(b gopacket.SerializeBuffer, opts 
gopacket.SerializeOptions) error {
+       var optionData []byte
+       for _,opt := range i.Options {
+               optionData = append(optionData, 
ipv6HeaderTLVOption(opt).Data()...)
+       }
+       bytes, err := b.PrependBytes(2+len(optionData))
+       if err != nil {
+               return err
+       }
+       bytes[0] = uint8(i.NextHeader)
+       bytes[1] = i.HeaderLength
+       copy(bytes[2:], optionData)
+       return nil
+}

What steps will reproduce the problem?
1.Build pcap on a Linux ssytem using Musl libc not glibc


What is the expected output? What do you see instead?
Should build. Instead see
# code.google.com/p/gopacket/pcap
38: error: '__time_t' undeclared (first use in this function)
38: error: '__suseconds_t' undeclared (first use in this function)

What version of the product are you using? On what operating system?
f082f8277fb7d43caea5a997f615a33bf65fa102
on Alpine Linux 3.0.

Please provide any additional information below.

Musl libc just provides the Posix type names not any typedefs. Changing the 
conditionals as below so that the Posix types are the default seems entirely 
correct...

The following patch fixes the issue and also works fine on glibc

diff --git a/pcap/pcap.go b/pcap/pcap.go
index 76a4493..c71e613 100644
--- a/pcap/pcap.go
+++ b/pcap/pcap.go
@@ -79,9 +79,12 @@ int pcap_set_rfmon(pcap_t *p, int rfmon) {
 #elif __APPLE__
 #define gopacket_time_secs_t __darwin_time_t
 #define gopacket_time_usecs_t __darwin_suseconds_t
-#else
+#elif __GLIBC__
 #define gopacket_time_secs_t __time_t
 #define gopacket_time_usecs_t __suseconds_t
+#else
+#define gopacket_time_secs_t time_t
+#define gopacket_time_usecs_t suseconds_t
 #endif
 */
 import "C"

Hello!

Here http://godoc.org/code.google.com/p/gopacket/pfring I found this example:
 if ring, err := pfring.NewRing("eth0", 65536, pfring.FlagPromisc); err != nil {
   panic(err)
 } else if err := ring.SetBPFFilter("tcp and port 80"); err != nil {  // optional
   panic(err)
 } else if err := ring.Enable(); err != nil { // Must do this!, or you get no packets!
   panic(err)
 } else {
   packetSource := gopacket.NewPacketSource(ring, gopacket.LinkTypeEthernet)
     for packet := range packetSource.Packets() {
    fmt.Println(packet)
     //handlePacket(packet)  // Do something with a packet here.
   }   
 }

But it has one mistake which prevent correct compiling:
go build example.go 
# command-line-arguments
./example.go:15: undefined: gopacket.LinkTypeEthernet 

You should replace gopacket.LinkTypeEthernet by layers.LayerTypeEthernet and 
add importing: 
import "code.google.com/p/gopacket/layers"

After this fixes all works prefectly.

Thank you!

What steps will reproduce the problem?

Run the attached program, passing it the name of an interface that does not 
have an IPv4 address assigned:

What is the expected output? What do you see instead?

I see:

  SetBPFFilter: br1: no IPv4 address assigned

I would expect it to complete without error.

What version of the product are you using? On what operating system?

I'm using the current version of gopacket from git (commit a6efa31399883e135f).

Please provide any additional information below.

If one runs tcpdump using the -i option to listen on an interface without an 
assigned IPv4 address, it prints:

  tcpdump: WARNING: br1: no IPv4 address assigned

But then proceeds to work normally.

Note that the test program does complete without error under gopacket v1.1.8.  
I believe the issue was introduced in commit 7c2719.  I'd suggest that if the 
call to pcap_lookupnet fails,
it should fall back to using PCAP_NETMASK_UNKNOWN for maskp.

In immediate mode packets get delivered to the application as soon as they 
arrive, rather than after a timeout. This makes it very important for latency 
sensitive live captures. In my app this cuts the latency introduced by pcap 
from 2.5ms to 0.5ms.

The function was introduced in 
https://github.com/the-tcpdump-group/libpcap/commit/48bc6c35b191857f39b628bd586b
d94a03fd13d7 and released with libpcap 1.5.0 on 30th October 2013. The docs for 
it are, erhm, bare. Best explanation for the issue it is addressing is at 
http://stackoverflow.com/questions/15979033/libpcap-not-receiving-in-real-time-s
eems-to-be-buffering-packets.

Curiously, when using earlier versions of pcap, such as 1.3.0, which is in 
Debian Wheezy - the current 'stable', I do not experience the 2.5ms delay. The 
entire area of timeouts in pcap is a dog's breakfast (largely thanks to o/s and 
kernel differences), and has seen many changes.

Patch available on a branch at 
https://code.google.com/r/matthiasradestock-gopacket-pcap/source/list?name=pcap_
set_immediate_mode

What steps will reproduce the problem?
1. The code:
-------------------------
package main

import (
        "fmt"
        "code.google.com/p/gopacket"
        "code.google.com/p/gopacket/layers"
)

func main() {
        sb := gopacket.NewSerializeBuffer()
        gopacket.SerializeLayers(sb, gopacket.SerializeOptions{
                ComputeChecksums:true,
        }, layers.SCTP{})
        fmt.Print(sb.Bytes())
}

-------------------------

What is the expected output? What do you see instead?

expected:

[0 0 0 0 0 0 0 0 93 181 96 43]

instead:

# command-line-arguments
./hoge.go:13: cannot use layers.SCTP literal (type layers.SCTP) as type 
gopacket.SerializableLayer in function argument:
        layers.SCTP does not implement gopacket.SerializableLayer (missing SerializeTo method)


Please provide any additional information below.

diff --git a/layers/sctp.go b/layers/sctp.go
index 1d84506..28436de 100644
--- a/layers/sctp.go
+++ b/layers/sctp.go
@@ -51,6 +51,107 @@ func decodeWithSCTPChunkTypePrefix(data []byte, p 
gopacket.PacketBuilder) error
    return chunkType.Decode(data, p)
 }

+// SerializeTo is for gopacket.SerializableLayer.
+func (s SCTP) SerializeTo(b gopacket.SerializeBuffer, opts 
gopacket.SerializeOptions) error {
+   var payload []byte
+   if opts.ComputeChecksums {
+       payload = b.Bytes()
+   }
+   bytes, err := b.PrependBytes(12)
+   if err != nil {
+       return err
+   }
+   binary.BigEndian.PutUint16(bytes[0:2], uint16(s.SrcPort))
+   binary.BigEndian.PutUint16(bytes[2:4], uint16(s.DstPort))
+   binary.BigEndian.PutUint32(bytes[4:8], s.VerificationTag)
+   if opts.ComputeChecksums {
+       binary.LittleEndian.PutUint32(bytes[8:12], s.computeChecksum(payload))
+   }
+   return nil
+}
+
+func (s SCTP) computeChecksum(payload []byte) uint32 {
+   s.Checksum = 0
+   sb := gopacket.NewSerializeBuffer()
+   s.SerializeTo(sb, gopacket.SerializeOptions{ComputeChecksums: false})
+   // RFC 3309
+   crc_c := [256]uint32{
+       0x00000000, 0xF26B8303, 0xE13B70F7, 0x1350F3F4,
+       0xC79A971F, 0x35F1141C, 0x26A1E7E8, 0xD4CA64EB,
+       0x8AD958CF, 0x78B2DBCC, 0x6BE22838, 0x9989AB3B,
+       0x4D43CFD0, 0xBF284CD3, 0xAC78BF27, 0x5E133C24,
+       0x105EC76F, 0xE235446C, 0xF165B798, 0x030E349B,
+       0xD7C45070, 0x25AFD373, 0x36FF2087, 0xC494A384,
+       0x9A879FA0, 0x68EC1CA3, 0x7BBCEF57, 0x89D76C54,
+       0x5D1D08BF, 0xAF768BBC, 0xBC267848, 0x4E4DFB4B,
+       0x20BD8EDE, 0xD2D60DDD, 0xC186FE29, 0x33ED7D2A,
+       0xE72719C1, 0x154C9AC2, 0x061C6936, 0xF477EA35,
+       0xAA64D611, 0x580F5512, 0x4B5FA6E6, 0xB93425E5,
+       0x6DFE410E, 0x9F95C20D, 0x8CC531F9, 0x7EAEB2FA,
+       0x30E349B1, 0xC288CAB2, 0xD1D83946, 0x23B3BA45,
+       0xF779DEAE, 0x05125DAD, 0x1642AE59, 0xE4292D5A,
+       0xBA3A117E, 0x4851927D, 0x5B016189, 0xA96AE28A,
+       0x7DA08661, 0x8FCB0562, 0x9C9BF696, 0x6EF07595,
+       0x417B1DBC, 0xB3109EBF, 0xA0406D4B, 0x522BEE48,
+       0x86E18AA3, 0x748A09A0, 0x67DAFA54, 0x95B17957,
+       0xCBA24573, 0x39C9C670, 0x2A993584, 0xD8F2B687,
+       0x0C38D26C, 0xFE53516F, 0xED03A29B, 0x1F682198,
+       0x5125DAD3, 0xA34E59D0, 0xB01EAA24, 0x42752927,
+       0x96BF4DCC, 0x64D4CECF, 0x77843D3B, 0x85EFBE38,
+       0xDBFC821C, 0x2997011F, 0x3AC7F2EB, 0xC8AC71E8,
+       0x1C661503, 0xEE0D9600, 0xFD5D65F4, 0x0F36E6F7,
+       0x61C69362, 0x93AD1061, 0x80FDE395, 0x72966096,
+       0xA65C047D, 0x5437877E, 0x4767748A, 0xB50CF789,
+       0xEB1FCBAD, 0x197448AE, 0x0A24BB5A, 0xF84F3859,
+       0x2C855CB2, 0xDEEEDFB1, 0xCDBE2C45, 0x3FD5AF46,
+       0x7198540D, 0x83F3D70E, 0x90A324FA, 0x62C8A7F9,
+       0xB602C312, 0x44694011, 0x5739B3E5, 0xA55230E6,
+       0xFB410CC2, 0x092A8FC1, 0x1A7A7C35, 0xE811FF36,
+       0x3CDB9BDD, 0xCEB018DE, 0xDDE0EB2A, 0x2F8B6829,
+       0x82F63B78, 0x709DB87B, 0x63CD4B8F, 0x91A6C88C,
+       0x456CAC67, 0xB7072F64, 0xA457DC90, 0x563C5F93,
+       0x082F63B7, 0xFA44E0B4, 0xE9141340, 0x1B7F9043,
+       0xCFB5F4A8, 0x3DDE77AB, 0x2E8E845F, 0xDCE5075C,
+       0x92A8FC17, 0x60C37F14, 0x73938CE0, 0x81F80FE3,
+       0x55326B08, 0xA759E80B, 0xB4091BFF, 0x466298FC,
+       0x1871A4D8, 0xEA1A27DB, 0xF94AD42F, 0x0B21572C,
+       0xDFEB33C7, 0x2D80B0C4, 0x3ED04330, 0xCCBBC033,
+       0xA24BB5A6, 0x502036A5, 0x4370C551, 0xB11B4652,
+       0x65D122B9, 0x97BAA1BA, 0x84EA524E, 0x7681D14D,
+       0x2892ED69, 0xDAF96E6A, 0xC9A99D9E, 0x3BC21E9D,
+       0xEF087A76, 0x1D63F975, 0x0E330A81, 0xFC588982,
+       0xB21572C9, 0x407EF1CA, 0x532E023E, 0xA145813D,
+       0x758FE5D6, 0x87E466D5, 0x94B49521, 0x66DF1622,
+       0x38CC2A06, 0xCAA7A905, 0xD9F75AF1, 0x2B9CD9F2,
+       0xFF56BD19, 0x0D3D3E1A, 0x1E6DCDEE, 0xEC064EED,
+       0xC38D26C4, 0x31E6A5C7, 0x22B65633, 0xD0DDD530,
+       0x0417B1DB, 0xF67C32D8, 0xE52CC12C, 0x1747422F,
+       0x49547E0B, 0xBB3FFD08, 0xA86F0EFC, 0x5A048DFF,
+       0x8ECEE914, 0x7CA56A17, 0x6FF599E3, 0x9D9E1AE0,
+       0xD3D3E1AB, 0x21B862A8, 0x32E8915C, 0xC083125F,
+       0x144976B4, 0xE622F5B7, 0xF5720643, 0x07198540,
+       0x590AB964, 0xAB613A67, 0xB831C993, 0x4A5A4A90,
+       0x9E902E7B, 0x6CFBAD78, 0x7FAB5E8C, 0x8DC0DD8F,
+       0xE330A81A, 0x115B2B19, 0x020BD8ED, 0xF0605BEE,
+       0x24AA3F05, 0xD6C1BC06, 0xC5914FF2, 0x37FACCF1,
+       0x69E9F0D5, 0x9B8273D6, 0x88D28022, 0x7AB90321,
+       0xAE7367CA, 0x5C18E4C9, 0x4F48173D, 0xBD23943E,
+       0xF36E6F75, 0x0105EC76, 0x12551F82, 0xE03E9C81,
+       0x34F4F86A, 0xC69F7B69, 0xD5CF889D, 0x27A40B9E,
+       0x79B737BA, 0x8BDCB4B9, 0x988C474D, 0x6AE7C44E,
+       0xBE2DA0A5, 0x4C4623A6, 0x5F16D052, 0xAD7D5351,
+   }
+
+   crc32 := uint32(0xffffffff)
+   for _, b := range sb.Bytes() {
+       crc32 = (crc32 >> 8) ^ crc_c[(byte(crc32)^b)&0xFF]
+   }
+   for _, b := range payload {
+       crc32 = (crc32 >> 8) ^ crc_c[(byte(crc32)^b)&0xFF]
+   }
+   return 0xffffffff &^ crc32
+}
+
 // SCTPChunk contains the common fields in all SCTP chunks.
 type SCTPChunk struct {
    BaseLayer
@@ -102,6 +203,15 @@ func decodeSCTPParameter(data []byte) SCTPParameter {
    }
 }

+func (p SCTPParameter) Bytes() []byte {
+   length := 4 + len(p.Value)
+   data := make([]byte, roundUpToNearest4(length))
+   binary.BigEndian.PutUint16(data[0:2], p.Type)
+   binary.BigEndian.PutUint16(data[2:4], uint16(length))
+   copy(data[4:], p.Value)
+   return data
+}
+
 // SCTPUnknownChunkType is the layer type returned when we don't recognize the
 // chunk type.  Since there's a length in a known location, we can skip over
 // it even if we don't know what it is, and continue parsing the rest of the
@@ -119,6 +229,16 @@ func decodeSCTPChunkTypeUnknown(data []byte, p 
gopacket.PacketBuilder) error {
    return p.NextDecoder(gopacket.DecodeFunc(decodeWithSCTPChunkTypePrefix))
 }

+// SerializeTo is for gopacket.SerializableLayer.
+func (s SCTPUnknownChunkType) SerializeTo(b gopacket.SerializeBuffer, opts 
gopacket.SerializeOptions) error {
+   bytes, err := b.PrependBytes(s.ActualLength)
+   if err != nil {
+       return err
+   }
+   copy(bytes, s.bytes)
+   return nil
+}
+
 // LayerType returns gopacket.LayerTypeSCTPUnknownChunkType.
 func (s *SCTPUnknownChunkType) LayerType() gopacket.LayerType { return LayerTypeSCTPUnknownChunkType }

@@ -168,6 +288,34 @@ func decodeSCTPData(data []byte, p gopacket.PacketBuilder) 
error {
    return p.NextDecoder(gopacket.DecodeFunc(decodeWithSCTPChunkTypePrefix))
 }

+// SerializeTo is for gopacket.SerializableLayer.
+func (sc SCTPData) SerializeTo(b gopacket.SerializeBuffer, opts 
gopacket.SerializeOptions) error {
+   length := 16 + len(sc.PayloadData)
+   bytes, err := b.PrependBytes(roundUpToNearest4(length))
+   if err != nil {
+       return err
+   }
+   bytes[0] = uint8(sc.Type)
+   flags := uint8(0)
+   if sc.Unordered {
+       flags |= 0x4
+   }
+   if sc.BeginFragment {
+       flags |= 0x2
+   }
+   if sc.EndFragment {
+       flags |= 0x1
+   }
+   bytes[1] = flags
+   binary.BigEndian.PutUint16(bytes[2:4], uint16(length))
+   binary.BigEndian.PutUint32(bytes[4:8], sc.TSN)
+   binary.BigEndian.PutUint16(bytes[8:10], sc.StreamId)
+   binary.BigEndian.PutUint16(bytes[10:12], sc.StreamSequence)
+   binary.BigEndian.PutUint32(bytes[12:16], sc.PayloadProtocol)
+   copy(bytes[16:], sc.PayloadData)
+   return nil
+}
+
 // SCTPInitParameter is a parameter for an SCTP Init or InitAck packet.
 type SCTPInitParameter SCTPParameter

@@ -210,6 +358,30 @@ func decodeSCTPInit(data []byte, p gopacket.PacketBuilder) 
error {
    return p.NextDecoder(gopacket.DecodeFunc(decodeWithSCTPChunkTypePrefix))
 }

+// SerializeTo is for gopacket.SerializableLayer.
+func (sc SCTPInit) SerializeTo(b gopacket.SerializeBuffer, opts 
gopacket.SerializeOptions) error {
+   var payload []byte
+   for _, param := range sc.Parameters {
+       payload = append(payload, SCTPParameter(param).Bytes()...)
+   }
+   length := 20 + len(payload)
+
+   bytes, err := b.PrependBytes(roundUpToNearest4(length))
+   if err != nil {
+       return err
+   }
+   bytes[0] = uint8(sc.Type)
+   bytes[1] = sc.Flags
+   binary.BigEndian.PutUint16(bytes[2:4], uint16(length))
+   binary.BigEndian.PutUint32(bytes[4:8], sc.InitiateTag)
+   binary.BigEndian.PutUint32(bytes[8:12], sc.AdvertisedReceiverWindowCredit)
+   binary.BigEndian.PutUint16(bytes[12:14], sc.OutboundStreams)
+   binary.BigEndian.PutUint16(bytes[14:16], sc.InboundStreams)
+   binary.BigEndian.PutUint32(bytes[16:20], sc.InitialTSN)
+   copy(bytes[20:], payload)
+   return nil
+}
+
 // SCTPSack is the SCTP Selective ACK chunk layer.
 type SCTPSack struct {
    SCTPChunk
@@ -262,6 +434,30 @@ func decodeSCTPSack(data []byte, p gopacket.PacketBuilder) 
error {
    return p.NextDecoder(gopacket.DecodeFunc(decodeWithSCTPChunkTypePrefix))
 }

+// SerializeTo is for gopacket.SerializableLayer.
+func (sc SCTPSack) SerializeTo(b gopacket.SerializeBuffer, opts 
gopacket.SerializeOptions) error {
+   length := 16 + 2*len(sc.GapACKs) + 4*len(sc.DuplicateTSNs)
+   bytes, err := b.PrependBytes(roundUpToNearest4(length))
+   if err != nil {
+       return err
+   }
+   bytes[0] = uint8(sc.Type)
+   bytes[1] = sc.Flags
+   binary.BigEndian.PutUint16(bytes[2:4], uint16(length))
+   binary.BigEndian.PutUint32(bytes[4:8], sc.CumulativeTSNAck)
+   binary.BigEndian.PutUint32(bytes[8:12], sc.AdvertisedReceiverWindowCredit)
+   binary.BigEndian.PutUint16(bytes[12:14], uint16(len(sc.GapACKs)))
+   binary.BigEndian.PutUint16(bytes[14:16], uint16(len(sc.DuplicateTSNs)))
+   for i, v := range sc.GapACKs {
+       binary.BigEndian.PutUint16(bytes[16+i*2:], v)
+   }
+   offset := 16 + 2*len(sc.GapACKs)
+   for i, v := range sc.DuplicateTSNs {
+       binary.BigEndian.PutUint32(bytes[offset+i*4:], v)
+   }
+   return nil
+}
+
 // SCTPHeartbeatParameter is the parameter type used by SCTP heartbeat and
 // heartbeat ack layers.
 type SCTPHeartbeatParameter SCTPParameter
@@ -295,6 +491,25 @@ func decodeSCTPHeartbeat(data []byte, p 
gopacket.PacketBuilder) error {
    return p.NextDecoder(gopacket.DecodeFunc(decodeWithSCTPChunkTypePrefix))
 }

+// SerializeTo is for gopacket.SerializableLayer.
+func (sc SCTPHeartbeat) SerializeTo(b gopacket.SerializeBuffer, opts 
gopacket.SerializeOptions) error {
+   var payload []byte
+   for _, param := range sc.Parameters {
+       payload = append(payload, SCTPParameter(param).Bytes()...)
+   }
+   length := 4 + len(payload)
+
+   bytes, err := b.PrependBytes(roundUpToNearest4(length))
+   if err != nil {
+       return err
+   }
+   bytes[0] = uint8(sc.Type)
+   bytes[1] = sc.Flags
+   binary.BigEndian.PutUint16(bytes[2:4], uint16(length))
+   copy(bytes[4:], payload)
+   return nil
+}
+
 // SCTPErrorParameter is the parameter type used by SCTP Abort and Error layers.
 type SCTPErrorParameter SCTPParameter

@@ -328,6 +543,25 @@ func decodeSCTPError(data []byte, p 
gopacket.PacketBuilder) error {
    return p.NextDecoder(gopacket.DecodeFunc(decodeWithSCTPChunkTypePrefix))
 }

+// SerializeTo is for gopacket.SerializableLayer.
+func (sc SCTPError) SerializeTo(b gopacket.SerializeBuffer, opts 
gopacket.SerializeOptions) error {
+   var payload []byte
+   for _, param := range sc.Parameters {
+       payload = append(payload, SCTPParameter(param).Bytes()...)
+   }
+   length := 4 + len(payload)
+
+   bytes, err := b.PrependBytes(roundUpToNearest4(length))
+   if err != nil {
+       return err
+   }
+   bytes[0] = uint8(sc.Type)
+   bytes[1] = sc.Flags
+   binary.BigEndian.PutUint16(bytes[2:4], uint16(length))
+   copy(bytes[4:], payload)
+   return nil
+}
+
 // SCTPShutdown is the SCTP shutdown layer.
 type SCTPShutdown struct {
    SCTPChunk
@@ -346,6 +580,19 @@ func decodeSCTPShutdown(data []byte, p 
gopacket.PacketBuilder) error {
    return p.NextDecoder(gopacket.DecodeFunc(decodeWithSCTPChunkTypePrefix))
 }

+// SerializeTo is for gopacket.SerializableLayer.
+func (sc SCTPShutdown) SerializeTo(b gopacket.SerializeBuffer, opts 
gopacket.SerializeOptions) error {
+   bytes, err := b.PrependBytes(8)
+   if err != nil {
+       return err
+   }
+   bytes[0] = uint8(sc.Type)
+   bytes[1] = sc.Flags
+   binary.BigEndian.PutUint16(bytes[2:4], 8)
+   binary.BigEndian.PutUint32(bytes[4:8], sc.CumulativeTSNAck)
+   return nil
+}
+
 // SCTPShutdownAck is the SCTP shutdown layer.
 type SCTPShutdownAck struct {
    SCTPChunk
@@ -362,6 +609,18 @@ func decodeSCTPShutdownAck(data []byte, p 
gopacket.PacketBuilder) error {
    return p.NextDecoder(gopacket.DecodeFunc(decodeWithSCTPChunkTypePrefix))
 }

+// SerializeTo is for gopacket.SerializableLayer.
+func (sc SCTPShutdownAck) SerializeTo(b gopacket.SerializeBuffer, opts 
gopacket.SerializeOptions) error {
+   bytes, err := b.PrependBytes(4)
+   if err != nil {
+       return err
+   }
+   bytes[0] = uint8(sc.Type)
+   bytes[1] = sc.Flags
+   binary.BigEndian.PutUint16(bytes[2:4], 4)
+   return nil
+}
+
 // SCTPCookieEcho is the SCTP Cookie Echo layer.
 type SCTPCookieEcho struct {
    SCTPChunk
@@ -380,6 +639,20 @@ func decodeSCTPCookieEcho(data []byte, p 
gopacket.PacketBuilder) error {
    return p.NextDecoder(gopacket.DecodeFunc(decodeWithSCTPChunkTypePrefix))
 }

+// SerializeTo is for gopacket.SerializableLayer.
+func (sc SCTPCookieEcho) SerializeTo(b gopacket.SerializeBuffer, opts 
gopacket.SerializeOptions) error {
+   length := 4 + len(sc.Cookie)
+   bytes, err := b.PrependBytes(roundUpToNearest4(length))
+   if err != nil {
+       return err
+   }
+   bytes[0] = uint8(sc.Type)
+   bytes[1] = sc.Flags
+   binary.BigEndian.PutUint16(bytes[2:4], uint16(length))
+   copy(bytes[4:], sc.Cookie)
+   return nil
+}
+
 // This struct is used by all empty SCTP chunks (currently CookieAck and
 // ShutdownComplete).
 type SCTPEmptyLayer struct {
@@ -403,3 +676,15 @@ func decodeSCTPEmptyLayer(data []byte, p 
gopacket.PacketBuilder) error {
    p.AddLayer(sc)
    return p.NextDecoder(gopacket.DecodeFunc(decodeWithSCTPChunkTypePrefix))
 }
+
+// SerializeTo is for gopacket.SerializableLayer.
+func (sc SCTPEmptyLayer) SerializeTo(b gopacket.SerializeBuffer, opts 
gopacket.SerializeOptions) error {
+   bytes, err := b.PrependBytes(4)
+   if err != nil {
+       return err
+   }
+   bytes[0] = uint8(sc.Type)
+   bytes[1] = sc.Flags
+   binary.BigEndian.PutUint16(bytes[2:4], 4)
+   return nil
+}

What steps will reproduce the problem?
1. Install PF_RING using this manual on Debian 7 Wheezy: 
http://www.stableit.ru/2014/06/pfring-debian-7-wheezy.html
2. cp /opt/pf_ring/include/pfring.h /usr/include/; cp /opt/pf_ring/lib/* 
/usr/lib/
3. go get "code.google.com/p/gopacket/pfring" 

What is the expected output?
Compiled tool

What do you see instead?
 go get "code.google.com/p/gopacket/pfring"
# code.google.com/p/gopacket/pfring
/usr/lib/gcc/x86_64-linux-gnu/4.7/../../../../lib/libpfring.so: undefined 
reference to `numa_node_of_cpu'
/usr/lib/gcc/x86_64-linux-gnu/4.7/../../../../lib/libpfring.so: undefined 
reference to `clock_gettime'
/usr/lib/gcc/x86_64-linux-gnu/4.7/../../../../lib/libpfring.so: undefined 
reference to `numa_bind'
/usr/lib/gcc/x86_64-linux-gnu/4.7/../../../../lib/libpfring.so: undefined 
reference to `numa_parse_nodestring'
/usr/lib/gcc/x86_64-linux-gnu/4.7/../../../../lib/libpfring.so: undefined 
reference to `numa_available'

After this I added numa to linker config in 
/usr/share/go/src/pkg/code.google.com/p/gopacket/pfring/pfring.go and got new 
error:
go get "code.google.com/p/gopacket/pfring" 
/# code.google.com/p/gopacket/pfring
/usr/lib/gcc/x86_64-linux-gnu/4.7/../../../../lib/libpfring.so: undefined 
reference to `clock_gettime'
collect2: error: ld returned 1 exit status

For solve this I added 'rt' to linker config and tool builded successfully.

All compiles correctly with this flags:
#cgo LDFLAGS: -lpfring -lpcap -lnuma -lrt

Please fix it! 

What version of the product are you using? On what operating system?
go version go1.0.2

http://godoc.org/code.google.com/p/gopacket#hdr-Creating_Packet_Data

2nd code example includes:
gopacket.SerializeLayers(buf, opts,
  &layers.Ethernet{},
  &layers.IPv4{},
  &layers.TCP{},
  gopacket.Payload([]byte{1, 2, 3, 4}))

But Payload does not implement SerializableLayer. Only *Payload does, (and you 
can't add an inline &), so I get the error:

./myfile.go:266: cannot use payload (type gopacket.Payload) as type 
gopacket.SerializableLayer in argument to gopacket.SerializeLayers:
        gopacket.Payload does not implement gopacket.SerializableLayer (SerializeTo method has pointer receiver)

So I think you need to extract that out to

payload := gopacket.Payload([]byte{1, 2, 3, 4})
gopacket.SerializeLayers(buf, opts,
  &layers.Ethernet{},
  &layers.IPv4{},
  &layers.TCP{},
  &payload)

I would like to decode the data from an interface that is using a cooked socket 
for encapsulation. Is there an existing way of doing this w/ gopacket? I saw 
there's a link type for it (LinkTypeLinuxSLL) but I didn't see a decoder 
associated with it and it doesn't appear to be parsing the data correctly with 
the LayerTypeEthernet (as expected). In case it matters, I'm using the 
"gopacket.NewDecodingLayerParser(layers.LayerTypeEthernet,...)" to decode the 
packets.

1. Is there an existing decoder for processing packets from a cooked socket?

2. If not, what is the right way of doing it in gopacket?

3. Sort of related (since I'm dealing w/ virtual interfaces), but passing an 
interface ala "venet0:0" isn't recognized as a proper interface by the 
OpenLive() method.

Any thoughts/ guidance on this issue would be greatly appreciated. Thank you!

It would be nice to have a Radiotap decoder. See http://www.radiotap.org/.

I'll try to give this a shot over the weekend.

First off, this is a great library!

I'm using gopacket to reassemble TCP flows from captured pcap files. I notice 
that each direction is considered a flow and I was wondering what a good 
approach would be for combining the two halves into a single tcp connection or 
"conversation".

For instance, the attached image shows a wireshark conversations breakdown with 
64 TCP conversations. Running gopacket TCP assembly returns 128 TCP flows. 

I'm trying to think of the best way to merge the two halves. Right now I'm 
keeping a slice of flows and checking in ReassemblyComplete() to see if the new 
flow is the second half of an existing conversation. To do this I check:

existing.SrcAddr == newFlow.DstAddr
existing.SrcPort == newFlow.DstPort
existing.DstAddr == newFlow.SrcAddr
existing.DstPort == newFlow.SrcPort
existing.StartTime == newFlow.StartTime
existing.EndTime == newFlow.EndTime

The issue with this is the start and end times are a few micro seconds off 
generally, so I have to allow for a little fudge room.  I'm wondering what a 
cleaner way might be to implement this.

Perhaps I should try to implement this in the gopacket reassembly code or 
continue to do this by merging reassemblies after gopacket processed the flows.

Regards

When I calling SetImmediateMode (with true/false) I am getting a Generic Error,

This is my code:
https://gist.github.com/yosiat/84d4159e673442bcb91d

My operating system is Mac OS X 10.9.5 with go1.3.3 darwin/amd64


Why is this happening?

Hello, Greame! 

I tried to create http headers parser but can't find any support of http in 
gopacket :(

Do you have any plans about http?

I thought is so simple to add parser for http request because it fit in one 
packet:

22:37:13.663782 IP xx.xxx.xx.49296 > xx.xx.162.80: Flags [P.], seq 
657400533:657400931, ack 4094641111, win 4102, options [nop,nop,TS val 
770089273 ecr 2255323072], length 398
.M4....I....P'/"...C............
-..9.m..GET /wp-content/themes/sahifa/images/separate.png HTTP/1.1
Host: avtodailynews.ru
Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) 
AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A405 Safari/600.1.4
Accept-Language: ru
Referer: http://avtodailynews.ru/top-10-luchshix-krossoverov-2014-goda
Accept-Encoding: gzip, deflate

pcap_loop offers a neat and efficient way of capturing/reading packets 
continuously.

Patch available on a branch at 
https://code.google.com/r/matthiasradestock-gopacket-pcap/source/list?name=pcap_
loop

What steps will reproduce the problem?
1. ep = NewTCPPortEndpoint(layers.TCPPort(1010))
2. fmt.Println(hex.Dump(ep.Raw))


What is the expected output? What do you see instead?
expect 0x0a 0x0a 0x00....
see  0x00 0x0a 0x00...


What version of the product are you using? On what operating system?
git put from head on 9/23/14. On Ubuntu 12.04 / linux 3.8

Please provide any additional information below.

suggest this patch :

diff --git a/layers/endpoints.go b/layers/endpoints.go
index 03793a8..193eef1 100644
--- a/layers/endpoints.go
+++ b/layers/endpoints.go
@@ -64,7 +64,7 @@ func NewMACEndpoint(a net.HardwareAddr) gopacket.Endpoint {
        return gopacket.NewEndpoint(EndpointMAC, []byte(a))
 }
 func newPortEndpoint(t gopacket.EndpointType, p uint16) gopacket.Endpoint {
-       return gopacket.NewEndpoint(t, []byte{byte(p >> 16), byte(p)})
+       return gopacket.NewEndpoint(t, []byte{byte(p >> 8), byte(p)})
 }

 // NewTCPPortEndpoint returns an endpoint based on a TCP port.

Hello!

For this simple code http://play.golang.org/p/E2CakSJ-7s I found unexpectedly 
big memory consumption and possible memory leak.


/usr/bin/time --verbose ./anomaly_detector
unexpected fault address 0x7f1f3e3ea828
throw: fault
[signal 0xb code=0x1 addr=0x7f1f3e3ea828 pc=0x7f1efd3963e0]

goroutine 1 [chan receive]:
main.main()
    /root/traffic_anomaly_detector/anomaly_detector.go:23 +0x1ce

goroutine 2 [syscall]:
created by runtime.main
    /home/michael/DPKG/golang/src/pkg/runtime/proc.c:221

goroutine 3 [syscall]:
code.google.com/p/gopacket/pfring._Cfunc_pfring_recv(0x4b0c2e0, 0xf84053d1d0)
    /tmp/go-build365217384/code.google.com/p/gopacket/pfring/_obj/_cgo_defun.c:105 +0x2f
code.google.com/p/gopacket/pfring.(*Ring).ReadPacketDataTo(0xf84053d0f0, 
0xf8422c9e80, 0x8000000080, 0x0, 0x0, ...)
    /tmp/go-build365217384/code.google.com/p/gopacket/pfring/_obj/_cgo_gotypes.go:927 +0xae
code.google.com/p/gopacket/pfring.(*Ring).ReadPacketData(0xf84053d0f0, 
0xf8422c9e80, 0x8000000080, 0x0, 0x0, ...)
    /tmp/go-build365217384/code.google.com/p/gopacket/pfring/_obj/_cgo_gotypes.go:945 +0xca
code.google.com/p/gopacket.(*PacketSource).NextPacket(0xf8417ff4b0, 
0xf841803000, 0xf840152f00, 0xf8422cc900)
    /usr/lib/go/src/pkg/code.google.com/p/gopacket/packet.go:658 +0x57
code.google.com/p/gopacket.(*PacketSource).packetsToChannel(0xf8417ff4b0, 
0xf841803000, 0x0, 0x0)
    /usr/lib/go/src/pkg/code.google.com/p/gopacket/packet.go:675 +0x45
created by code.google.com/p/gopacket.(*PacketSource).Packets
    /usr/lib/go/src/pkg/code.google.com/p/gopacket/packet.go:695 +0x54
Command exited with non-zero status 2
    Command being timed: "./anomaly_detector"
    User time (seconds): 0.55
    System time (seconds): 0.08
    Percent of CPU this job got: 83%
    Elapsed (wall clock) time (h:mm:ss or m:ss): 0:00.77
    Average shared text size (kbytes): 0
    Average unshared data size (kbytes): 0
    Average stack size (kbytes): 0
    Average total size (kbytes): 0
    Maximum resident set size (kbytes): 46196
    Average resident set size (kbytes): 0
    Major (requiring I/O) page faults: 0
    Minor (reclaiming a frame) page faults: 13666
    Voluntary context switches: 25921
    Involuntary context switches: 163
    Swaps: 0
    File system inputs: 0
    File system outputs: 0
    Socket messages sent: 0
    Socket messages received: 0
    Signals delivered: 0
    Page size (bytes): 4096
    Exit status: 2

While decoding MPLS, if StackBottom was false, the next payload will be MPLS.

diff --git a/layers/mpls.go b/layers/mpls.go
index 61f4bbb..d0a3d33 100644
--- a/layers/mpls.go
+++ b/layers/mpls.go
@@ -54,14 +54,19 @@ var MPLSPayloadDecoder gopacket.Decoder = 
ProtocolGuessingDecoder{}

 func decodeMPLS(data []byte, p gopacket.PacketBuilder) error {
        decoded := binary.BigEndian.Uint32(data[:4])
-       p.AddLayer(&MPLS{
+       mpls := MPLS{
                Label:        decoded >> 12,
                TrafficClass: uint8(decoded>>9) & 0x7,
                StackBottom:  decoded&0x100 != 0,
                TTL:          uint8(decoded),
                BaseLayer:    BaseLayer{data[:4], data[4:]},
-       })
-       return p.NextDecoder(MPLSPayloadDecoder)
+       }
+       p.AddLayer(&mpls)
+       if mpls.StackBottom {
+               return p.NextDecoder(MPLSPayloadDecoder)
+       } else {
+               return p.NextDecoder(gopacket.DecodeFunc(decodeMPLS))
+       }
 }

 // SerializeTo writes the serialized form of this layer into the

diff --git a/layers/enums.go b/layers/enums.go
index 6dbe811..62fde61 100644
--- a/layers/enums.go
+++ b/layers/enums.go
@@ -75,6 +75,7 @@ const (
        IPProtocolAH           IPProtocol = 51
        IPProtocolICMPv6       IPProtocol = 58
        IPProtocolNoNextHeader IPProtocol = 59
+       IPProtocolIPv6Destination IPProtocol = 60
        IPProtocolIPIP         IPProtocol = 94
        IPProtocolEtherIP      IPProtocol = 97
        IPProtocolSCTP         IPProtocol = 132
@@ -442,6 +443,7 @@ func init() {
        IPProtocolMetadata[IPProtocolIPv6HopByHop] = EnumMetadata{DecodeWith: gopacket.DecodeFunc(decodeIPv6HopByHop), Name: "IPv6HopByHop", LayerType: LayerTypeIPv6Hop
        IPProtocolMetadata[IPProtocolIPv6Routing] = EnumMetadata{DecodeWith: gopacket.DecodeFunc(decodeIPv6Routing), Name: "IPv6Routing", LayerType: LayerTypeIPv6Routin
        IPProtocolMetadata[IPProtocolIPv6Fragment] = EnumMetadata{DecodeWith: gopacket.DecodeFunc(decodeIPv6Fragment), Name: "IPv6Fragment", LayerType: LayerTypeIPv6Fra
+       IPProtocolMetadata[IPProtocolIPv6Destination] = 
EnumMetadata{DecodeWith: gopacket.DecodeFunc(decodeIPv6Destination), Name: 
"IPv6Destination", LayerType: LayerTy
        IPProtocolMetadata[IPProtocolAH] = EnumMetadata{DecodeWith: gopacket.DecodeFunc(decodeIPSecAH), Name: "IPSecAH", LayerType: LayerTypeIPSecAH}
        IPProtocolMetadata[IPProtocolESP] = EnumMetadata{DecodeWith: gopacket.DecodeFunc(decodeIPSecESP), Name: "IPSecESP", LayerType: LayerTypeIPSecESP}
        IPProtocolMetadata[IPProtocolUDPLite] = EnumMetadata{DecodeWith: gopacket.DecodeFunc(decodeUDPLite), Name: "UDPLite", LayerType: LayerTypeUDPLite}

I wrote this code and run it on machine with heavy traffic load (200 kpps and 
multiple Gbps). http://play.golang.org/p/gaNjiuLDMN

PACKET: 60 bytes, wire length 60 cap length 60 @ 2014-06-24 00:33:47.774857 
+0400 MSK
- Layer 1 (14 bytes) = Ethernet {Contents=[...] Payload=[...] 
SrcMAC=5c:5e:ab:24:0f:c0 DstMAC=90:e2:ba:49:85:c8 EthernetType=IPv4 Length=0}
- Layer 2 (20 bytes) = IPv4 {Contents=[...] Payload=[...] Version=4 IHL=5 TOS=0 
Length=40 Id=21274 Flags=DF FragOffset=0 TTL=121 Protocol=TCP Checksum=3492 
SrcIP=176.15.237.106 DstIP=185.4.74.147 Options=[] Padding=[]}
- Layer 3 (20 bytes) = TCP  {Contents=[...] Payload=[] SrcPort=51920 
DstPort=80(http) Seq=3099176645 Ack=2054745823 DataOffset=5 FIN=false SYN=false 
RST=false PSH=false ACK=true URG=false ECE=false CWR=false NS=false Window=256 
Checksum=29130 Urgent=0 Options=[] Padding=[]}

PACKET: 90 bytes, wire length 90 cap length 90 @ 2014-06-24 00:33:47.774862 
+0400 MSK
- Layer 1 (14 bytes) = Ethernet {Contents=[...] Payload=[...] 
SrcMAC=90:e2:ba:49:85:c8 DstMAC=00:19:e2:b1:ef:c1 EthernetType=IPv4 Length=0}
- Layer 2 (20 bytes) = IPv4 {Contents=[...] Payload=[...] Version=4 IHL=5 
TOS=192 Length=76 Id=27205 Flags= FragOffset=0 TTL=64 Protocol=ICMPv4 
Checksum=39893 SrcIP=195.222.9.2 DstIP=91.234.75.12 Options=[] Padding=[]}
- Layer 3 (08 bytes) = ICMPv4   {Contents=[...] Payload=[...] 
TypeCode=DestinationUnreachable(Host) Checksum=23393 Id=0 Seq=0}
- Layer 4 (48 bytes) = Payload  48 byte(s)

PACKET: 128 bytes, truncated, wire length 590 cap length 128 @ 2014-06-24 
00:33:47.774868 +0400 MSK
- Layer 1 (14 bytes) = Ethernet {Contents=[...] Payload=[...] 
SrcMAC=00:19:e2:b1:ef:c1 DstMAC=90:e2:ba:49:85:c8 EthernetType=IPv4 Length=0}
- Layer 2 (20 bytes) = IPv4 {Contents=[...] Payload=[...] Version=4 IHL=5 
TOS=24 Length=576 Id=9892 Flags=DF FragOffset=0 TTL=54 Protocol=UDP 
Checksum=15117 SrcIP=192.99.19.45 DstIP=46.36.223.47 Options=[] Padding=[]}
- Layer 3 (08 bytes) = UDP  {Contents=[...] Payload=[...] SrcPort=8849 
DstPort=5060(sip) Length=556 Checksum=39383}
- Layer 4 (86 bytes) = Payload  86 byte(s)

PACKET: 90 bytes, wire length 90 cap length 90 @ 2014-06-24 00:33:47.77487 
+0400 MSK
- Layer 1 (14 bytes) = Ethernet {Contents=[...] Payload=[...] 
SrcMAC=90:e2:ba:49:85:c8 DstMAC=00:19:e2:b1:ef:c1 EthernetType=IPv4 Length=0}
- Layer 2 (20 bytes) = IPv4 {Contents=[...] Payload=[...] Version=4 IHL=5 
TOS=192 Length=76 Id=31606 Flags= FragOffset=0 TTL=64 Protocol=ICMPv4 
Checksum=28815 SrcIP=195.222.9.2 DstIP=81.5.112.6 Options=[] Padding=[]}
- Layer 3 (08 bytes) = ICMPv4   {Contents=[...] Payload=[...] 
TypeCode=DestinationUnreachable(Host) Checksum=30070 Id=0 Seq=0}
- Layer 4 (48 bytes) = Payload  48 byte(s)

PACKET: 90 bytes, wire length 90 cap length 90 @ 2014-06-24 00:33:47.774872 
+0400 MSK
- Layer 1 (14 bytes) = Ethernet {Contents=[...] Payload=[...] 
SrcMAC=90:e2:ba:49:85:c8 DstMAC=00:19:e2:b1:ef:c1 EthernetType=IPv4 Length=0}
- Layer 2 (20 bytes) = IPv4 {Contents=[...] Payload=[...] Version=4 IHL=5 
TOS=192 Length=76 Id=31607 Flags= FragOffset=0 TTL=64 Protocol=ICMPv4 
Checksum=28814 SrcIP=195.222.9.2 DstIP=81.5.112.6 Options=[] Padding=[]}
- Layer 3 (08 bytes) = ICMPv4   {Contents=[...] Payload=[...] 
TypeCode=DestinationUnreachable(Host) Checksum=30070 Id=0 Seq=0}
- Layer 4 (48 bytes) = Payload  48 byte(s)

PACKET: 60 bytes, wire length 60 cap length 60 @ 2014-06-24 00:33:47.774882 
+0400 MSK
- Layer 1 (14 bytes) = Ethernet {Contents=[...] Payload=[...] 
SrcMAC=90:e2:ba:49:85:c8 DstMAC=5c:5e:ab:24:0f:c0 EthernetType=IPv4 Length=0}
- Layer 2 (20 bytes) = IPv4 {Contents=[...] Payload=[...] Version=4 IHL=5 TOS=0 
Length=40 Id=48437 Flags=DF FragOffset=0 TTL=63 Protocol=TCP Checksum=20186 
SrcIP=46.36.217.145 DstIP=109.104.186.162 Options=[] Padding=[]}
- Layer 3 (20 bytes) = TCP  {Contents=[...] Payload=[] SrcPort=80(http) 
DstPort=65014 Seq=60442492 Ack=3036003759 DataOffset=5 FIN=false SYN=false 
RST=false PSH=false ACK=true URG=false ECE=false CWR=false NS=false Window=123 
Checksum=50070 Urgent=0 Options=[] Padding=[]}

PACKET: 66 bytes, wire length 66 cap length 66 @ 2014-06-24 00:33:47.774884 
+0400 MSK
- Layer 1 (14 bytes) = Ethernet {Contents=[...] Payload=[...] 
SrcMAC=5c:5e:ab:24:0f:c0 DstMAC=90:e2:ba:49:85:c8 EthernetType=IPv4 Length=0}
- Layer 2 (20 bytes) = IPv4 {Contents=[...] Payload=[...] Version=4 IHL=5 TOS=0 
Length=52 Id=59742 Flags=DF FragOffset=0 TTL=53 Protocol=TCP Checksum=10127 
SrcIP=37.144.10.85 DstIP=185.4.75.237 Options=[] Padding=[]}
- Layer 3 (32 bytes) = TCP  {Contents=[...] Payload=[] SrcPort=49727 
DstPort=80(http) Seq=554718483 Ack=2300924346 DataOffset=8 FIN=false SYN=false 
RST=false PSH=false ACK=true URG=false ECE=false CWR=false NS=false Window=8192 
Checksum=56362 Urgent=0 Options=[NOP, NOP, TSOPT:1035842371/1832834025] 
Padding=[]}

PACKET: 128 bytes, truncated, wire length 1514 cap length 128 @ 2014-06-24 
00:33:47.774892 +0400 MSK
- Layer 1 (14 bytes) = Ethernet {Contents=[...] Payload=[...] 
SrcMAC=90:e2:ba:49:85:c8 DstMAC=00:19:e2:b1:ef:c1 EthernetType=IPv4 Length=0}
- Layer 2 (20 bytes) = IPv4 {Contents=[...] Payload=[...] Version=4 IHL=5 TOS=0 
Length=1500 Id=27441 Flags=DF FragOffset=0 TTL=63 Protocol=TCP Checksum=5691 
SrcIP=46.36.218.220 DstIP=195.225.231.205 Options=[] Padding=[]}
- Layer 3 (20 bytes) = TCP  {Contents=[...] Payload=[...] SrcPort=80(http) 
DstPort=62963 Seq=979397143 Ack=2569684808 DataOffset=5 FIN=false SYN=false 
RST=false PSH=false ACK=true URG=false ECE=false CWR=false NS=false Window=244 
Checksum=18320 Urgent=0 Options=[] Padding=[]}
- Layer 4 (74 bytes) = Payload  74 byte(s)

PACKET: 128 bytes, truncated, wire length 1470 cap length 128 @ 2014-06-24 
00:33:47.774894 +0400 MSK
- Layer 1 (14 bytes) = Ethernet {Contents=[...] Payload=[...] 
SrcMAC=90:e2:ba:49:85:c8 DstMAC=5c:5e:ab:24:0f:c0 EthernetType=IPv4 Length=0}
- Layer 2 (20 bytes) = IPv4 {Contents=[...] Payload=[...] Version=4 IHL=5 TOS=0 
Length=1456 Id=56114 Flags=DF FragOffset=0 TTL=63 Protocol=TCP Checksum=14375 
SrcIP=159.253.18.30 DstIP=89.179.23.32 Options=[] Padding=[]}
- Layer 3 (32 bytes) = TCP  {Contents=[...] Payload=[...] SrcPort=80(http) 
DstPort=62699 Seq=2616046615 Ack=3804483635 DataOffset=8 FIN=false SYN=false 
RST=false PSH=false ACK=true URG=false ECE=false CWR=false NS=false Window=124 
Checksum=24274 Urgent=0 Options=[NOP, NOP, TSOPT:1968437833/893665661] 
Padding=[]}
- Layer 4 (62 bytes) = Payload  62 byte(s)

PACKET: 128 bytes, truncated, wire length 1506 cap length 128 @ 2014-06-24 
00:33:47.774895 +0400 MSK
- Layer 1 (14 bytes) = Ethernet {Contents=[...] Payload=[...] 
SrcMAC=90:e2:ba:49:85:c8 DstMAC=00:19:e2:b1:ef:c1 EthernetType=IPv4 Length=0}
- Layer 2 (20 bytes) = IPv4 {Contents=[...] Payload=[...] Version=4 IHL=5 TOS=0 
Length=1492 Id=1996 Flags=DF FragOffset=0 TTL=63 Protocol=TCP Checksum=29695 
SrcIP=159.253.19.51 DstIP=5.166.1.131 Options=[] Padding=[]}
- Layer 3 (32 bytes) = TCP  {Contents=[...] Payload=[...] SrcPort=80(http) 
DstPort=58461 Seq=1902176586 Ack=3712428238 DataOffset=8 FIN=false SYN=false 
RST=false PSH=false ACK=true URG=false ECE=false CWR=false NS=false Window=133 
Checksum=5254 Urgent=0 Options=[NOP, NOP, TSOPT:2862413908/747611987] 
Padding=[]}
- Layer 4 (62 bytes) = Payload  62 byte(s)

unexpected fault address 0x7fe10a545fd0
throw: fault
[signal 0xb code=0x1 addr=0x7fe10a545fd0 pc=0x7fe0900613e0]

goroutine 1 [running]:
os.(*File).pread(0x7fe090ce0e18, 0x406bb0, 0x44baf9, 0xf84014e048, 0x51c038, 
...)
    /usr/lib/go/src/pkg/os/file_unix.go:170 +0x77

goroutine 2 [syscall]:
created by runtime.main
    /home/michael/DPKG/golang/src/pkg/runtime/proc.cPACKET: 66 bytes, wire length 66 cap length 66 @ 2014-06-24 00:33:47.774896 +0400 MSK
- Layer 1 (14 bytes) = Ethernet {Contents=[...] Payload=[...] 
SrcMAC=90:e2:ba:49:85:c8 DstMAC=5c:5e:ab:24:0f:c0 EthernetType=IPv4 Length=0}
- Layer 2 (20 bytes) = IPv4 {Contents=[...] Payload=[...] Version=4 IHL=5 TOS=0 
Length=52 Id=54525 Flags=DF FragOffset=0 TTL=63 Protocol=TCP Checksum=12784 
SrcIP=185.4.75.237 DstIP=37.144.10.85 Options=[] Padding=[]}
- Layer 3 (32 bytes) = TCP  {Contents=[...] Payload=[] SrcPort=80(http) 
DstPort=49740 Seq=817692827 Ack=3422666756 DataOffset=8 FIN=false SYN=false 
RST=false PSH=false ACK=true URG=false ECE=false CWR=false NS=false Window=122 
Checksum=36559 Urgent=0 Options=[NOP, NOP, TSOPT:1832834150/1035842367] 
Padding=[]}

:221

goroutine 3 [syscall]:
code.google.com/p/gopacket/pfring._Cfunc_pfring_recv(0x2d4e2e0, 0xf84014dd10)
    /tmp/go-build365217384/code.google.com/p/gopacket/pfring/_obj/_cgo_defun.c:105 +0x2f
code.google.com/p/gopacket/pfring.(*Ring).ReadPacketDataTo(0xf84014dc30, 
0xf8425c3a00, 0x8000000080, 0x0, 0x0, ...)
    /tmp/go-build365217384/code.google.com/p/gopacket/pfring/_obj/_cgo_gotypes.go:927 +0xae
code.google.com/p/gopacket/pfring.(*Ring).ReadPacketData(0xf84014dc30, PACKET: 
60 bytes, wire length 60 cap length 60 @ 2014-06-24 00:33:47.774897 +0400 MSK
- Layer 1 (14 bytes) = Ethernet {Contents=[...] Payload=[...] 
SrcMAC=5c:5e:ab:24:0f:c0 DstMAC=90:e2:ba:49:85:c8 EthernetType=IPv4 Length=0}
- Layer 2 (20 bytes) = IPv4 {Contents=[...] Payload=[...] Version=4 IHL=5 TOS=0 
Length=40 Id=14897 Flags=DF FragOffset=0 TTL=121 Protocol=TCP Checksum=38878 
SrcIP=109.104.186.162 DstIP=46.36.217.145 Options=[] Padding=[]}
- Layer 3 (20 bytes) = TCP  {Contents=[...] Payload=[] SrcPort=65013 
DstPort=80(http) Seq=4102169961 Ack=2978335724 DataOffset=5 FIN=false SYN=false 
RST=false PSH=false ACK=true URG=false ECE=false CWR=false NS=false 
Window=16560 Checksum=43455 Urgent=0 Options=[] Padding=[]}

0xf8425c3a00, 0x8000000080, 0x0, 0x0, ...)
    /tmp/go-build365217384/code.google.com/p/gopacket/pfring/_obj/_cgo_gotypes.go:945 +0xca
code.google.com/p/gopacket.(*PacketSource).NextPacket(0xf8417ff4b0, 
0xf841803000, 0xf840151f00, 0xf8425d2a20)
    /usr/lib/go/src/pkg/code.google.com/p/gopacket/packet.go:658 +0x57
code.google.com/p/gopacket.(*PacketSource).packetsToChannel(0xf8417ff4b0, 
0xf841803000, 0x0, 0x0)
    /usr/lib/go/src/pkg/code.google.com/p/gopacket/packet.go:675 +0x45
created by code.google.com/p/gopacket.(*PacketSource).Packets
    /usr/lib/go/src/pkg/code.google.com/p/gopacket/packet.go:695 +0x54


And without packet priting http://play.golang.org/p/E2CakSJ-7s I got:
unexpected fault address 0x7fd8dbe4c3d8
throw: fault
[signal 0xb code=0x1 addr=0x7fd8dbe4c3d8 pc=0x7fd8cd0ef3e0]

goroutine 1 [chan receive]:
main.main()
    /root/traffic_anomaly_detector/anomaly_detector.go:23 +0x1ce

goroutine 2 [syscall]:
created by runtime.main
    /home/michael/DPKG/golang/src/pkg/runtime/proc.c:221

goroutine 3 [syscall]:
code.google.com/p/gopacket/pfring._Cfunc_pfring_recv(0x3fe02e0, 0xf840245d10)
    /tmp/go-build365217384/code.google.com/p/gopacket/pfring/_obj/_cgo_defun.c:105 +0x2f
code.google.com/p/gopacket/pfring.(*Ring).ReadPacketDataTo(0xf840245c30, 
0xf841f87e00, 0x8000000080, 0x0, 0x0, ...)
    /tmp/go-build365217384/code.google.com/p/gopacket/pfring/_obj/_cgo_gotypes.go:927 +0xae
code.google.com/p/gopacket/pfring.(*Ring).ReadPacketData(0xf840245c30, 
0xf841f87e00, 0x8000000080, 0x0, 0x0, ...)
    /tmp/go-build365217384/code.google.com/p/gopacket/pfring/_obj/_cgo_gotypes.go:945 +0xca
code.google.com/p/gopacket.(*PacketSource).NextPacket(0xf8418024b0, 
0xf841806000, 0xf840144f00, 0xf841f8b900)
    /usr/lib/go/src/pkg/code.google.com/p/gopacket/packet.go:658 +0x57
code.google.com/p/gopacket.(*PacketSource).packetsToChannel(0xf8418024b0, 
0xf841806000, 0x0, 0x0)
    /usr/lib/go/src/pkg/code.google.com/p/gopacket/packet.go:675 +0x45
created by code.google.com/p/gopacket.(*PacketSource).Packets
    /usr/lib/go/src/pkg/code.google.com/p/gopacket/packet.go:695 +0x54

tcpreader


func (r *ReaderStream) stripEmpty() {
    for len(r.current) > 0 && len(r.current[0].Bytes) == 0 {
        //r.current = r.current[:len(r.current)-1]   //bug?
        r.current = r.current[1:]    //?
        r.lossReported = false 
    }
}

What steps will reproduce the problem?
1. Run following code:

package main

import (
    "fmt"
    "code.google.com/p/gopacket/pcap"
)

func main() {
    if ifs, err := pcap.FindAllDevs(); err != nil {
        fmt.Print(err)
    } else {
        for _,nif := range ifs {
            fmt.Println(nif.Name)
            for _,net := range nif.Addresses {
                fmt.Println(">", net.IP, "/", net.Netmask)
            }
        }
    }
}


What is the expected output? What do you see instead?

root@ubuntu:~# go run e.go
nflog
nfqueue
p5p1
  192.168.1.204 / c0a801cc
  fe80::ea40:f2ff:fe09:652a / fe80000000000000ea40f2fffe09652a
any
lo
  127.0.0.1 / 7f000001
  ::1 / 00000000000000000000000000000001


What version of the product are you using? On what operating system?

root@ubuntu:~# go version
go version go1.2.1 linux/amd64
root@ubuntu:~# go get code.google.com/p/gopacket

Please provide any additional information below.

---------
diff --git a/pcap/pcap.go b/pcap/pcap.go
index 358c04e..1ecec84 100644
--- a/pcap/pcap.go
+++ b/pcap/pcap.go
@@ -384,7 +384,7 @@ func findalladdresses(addresses *_Ctype_struct_pcap_addr) 
(retval []InterfaceAdd
                if a.IP, err = sockaddr_to_IP((*syscall.RawSockaddr)(unsafe.Pointer(curaddr.addr))); err != nil {
                        continue
                }
-               if a.Netmask, err = 
sockaddr_to_IP((*syscall.RawSockaddr)(unsafe.Pointer(curaddr.addr))); err != 
nil {
+               if a.Netmask, err = 
sockaddr_to_IP((*syscall.RawSockaddr)(unsafe.Pointer(curaddr.netmask))); err != 
nil {
                        continue
                }
                retval = append(retval, a)


---------

This fix cause another issue with WinPcap(WpdPack_4_1_2.zip), that IPv6 netmask 
returned from the C library is not a valid. For that reason, sockaddr_to_IP 
drops IPv6 address and we only see IPv4 addrs.

What steps will reproduce the problem?
1. The code
package main

import (
        "code.google.com/p/gopacket"
        "code.google.com/p/gopacket/layers"
        "encoding/hex"
        "fmt"
)

func main() {
        if data,err := hex.DecodeString("222222222222121111111111810060640800"); err!=nil {
                panic(err)
        } else {
                buf := gopacket.NewSerializeBuffer()
                packet := gopacket.NewPacket(data, layers.LayerTypeEthernet, gopacket.Default)
                pl := packet.Layers()
                ps := make([]gopacket.SerializableLayer, len(pl))
                for i,p := range pl {
                        ps[i] = p.(gopacket.SerializableLayer)
                }
                if err:= gopacket.SerializeLayers(buf, gopacket.SerializeOptions{}, ps...); err!=nil {
                        panic(err)
                } else {
                        fmt.Println(hex.EncodeToString(buf.Bytes()))
                }
        }
}



2.
3.

What is the expected output? What do you see instead?

Actual:   222222222222121111111111810000640800...
Expected: 222222222222121111111111810060640800...

What version of the product are you using? On what operating system?


Please provide any additional information below.

diff --git a/layers/dot1q.go b/layers/dot1q.go
index f1cccff..1abdc01 100644
--- a/layers/dot1q.go
+++ b/layers/dot1q.go
@@ -27,7 +27,7 @@ func (d *Dot1Q) LayerType() gopacket.LayerType { return 
LayerTypeDot1Q }

 // DecodeFromBytes decodes the given bytes into this layer.
 func (d *Dot1Q) DecodeFromBytes(data []byte, df gopacket.DecodeFeedback) error {
-       d.Priority = (data[0] & 0xE0) >> 13
+       d.Priority = (data[0] & 0xE0) >> 5
        d.DropEligible = data[0]&0x10 != 0
        d.VLANIdentifier = binary.BigEndian.Uint16(data[:2]) & 0x0FFF
        d.Type = EthernetType(binary.BigEndian.Uint16(data[2:4]))
@@ -61,7 +61,7 @@ func (d *Dot1Q) SerializeTo(b gopacket.SerializeBuffer, opts 
gopacket.SerializeO
        if d.VLANIdentifier > 0xFFF {
                return fmt.Errorf("vlan identifier %v is too high", d.VLANIdentifier)
        }
-       firstBytes := uint16(d.Priority<<13) | d.VLANIdentifier
+       firstBytes := uint16(d.Priority)<<13 | d.VLANIdentifier
        if d.DropEligible {
                firstBytes |= 0x10
        }

What steps will reproduce the problem?
1. Install windows7 and winpcap 4.1.2 (latest dev branch as of today)
2. go build gopacket/pcap/example/pcapdump

What is the expected output? What do you see instead?

Expected: a pcapdump binary.
Received: link error: [snip]/pcap.go:309: undefined reference to 
`pcap_statustostr'
Note that the actual file line in the go file is 451.

What version of the product are you using? On what operating system?

windows7, winpcap 4.1.2, head of gopacket.

Please provide any additional information below.

WinPCAP currently doesn't export the pcap_statustostr() function:
http://www.winpcap.org/docs/docs_412/html/group__wpcapfunc.html
Looks like the closest would be the older pcap_strerror().

Hello! It's me again :)

I compiled (big win!) and run this code: 
https://gist.github.com/pavel-odintsov/b8e83c1575b7c5d81f0e

It works few seconds correctly:
Packet captured!
PACKET: 54 bytes, wire length 54 cap length 54 @ 2014-06-16 23:58:26.339531 
+0400 MSK
- Layer 1 (14 bytes) = Ethernet {Contents=[...] Payload=[...] 
SrcMAC=00:1b:21:b8:7f:52 DstMAC=28:c0:da:46:7e:94 EthernetType=IPv4 Length=0}
- Layer 2 (20 bytes) = IPv4 {Contents=[...] Payload=[...] Version=4 IHL=5 TOS=0 
Length=40 Id=0 Flags=DF FragOffset=0 TTL=64 Protocol=TCP Checksum=38040 
SrcIP=178.63.152.142 DstIP=186.2.161.103 Options=[] Padding=[]}
- Layer 3 (20 bytes) = TCP  {Contents=[...] Payload=[] SrcPort=21(ftp) 
DstPort=22(ssh) Seq=0 Ack=2226600473 DataOffset=5 FIN=false SYN=false RST=true 
PSH=false ACK=true URG=false ECE=false CWR=false NS=false Window=0 
Checksum=19101 Urgent=0 Options=[] Padding=[]}

But fail with stacktrace:
panic: runtime error: slice bounds out of range

goroutine 4 [running]:
runtime.panic(0x527040, 0x95ffaa)
    /usr/lib/golang/src/pkg/runtime/panic.c:266 +0xb6
code.google.com/p/gopacket/pfring.(*Ring).ReadPacketData(0xc21107a000, 
0xc211084a00, 0x80, 0x80, 0xecb314362, ...)
    /root/tests_pf_ring/src/code.google.com/p/gopacket/pfring/pfring.go:136 +0x166
code.google.com/p/gopacket.(*PacketSource).NextPacket(0xc21106f300, 
0xc21107b000, 0x7f8568ddcad0, 0xc211087240, 0x0)
    /root/tests_pf_ring/src/code.google.com/p/gopacket/packet.go:656 +0x3a
code.google.com/p/gopacket.(*PacketSource).packetsToChannel(0xc21106f300, 
0xc21107b000)
    /root/tests_pf_ring/src/code.google.com/p/gopacket/packet.go:672 +0x27
created by code.google.com/p/gopacket.(*PacketSource).Packets
    /root/tests_pf_ring/src/code.google.com/p/gopacket/packet.go:693 +0x53

goroutine 1 [chan receive]:
main.main()
    /root/tests_pf_ring/test.go:21 +0x21f

goroutine 3 [syscall]:
runtime.goexit()
    /usr/lib/golang/src/pkg/runtime/proc.c:1394

Could you help me with this bug?

I updated PF_RING to the last version from SVN, and now I can't manage to build 
gopacket. Any hints ?

# go build -x code.google.com/p/gopacket/pfring
WORK=/tmp/go-build544260297
mkdir -p $WORK/code.google.com/p/gopacket/_obj/
mkdir -p $WORK/code.google.com/p/
cd /root/lib/golib/src/code.google.com/p/gopacket
/root/lib/go/pkg/tool/linux_amd64/6g -o $WORK/code.google.com/p/gopacket.a 
-trimpath $WORK -p code.google.com/p/gopacket -complete -D 
_/root/lib/golib/src/code.google.com/p/gopacket -I $WORK -pack ./base.go 
./decode.go ./doc.go ./flows.go ./layerclass.go ./layertype.go ./packet.go 
./parser.go ./writer.go
mkdir -p $WORK/code.google.com/p/gopacket/pfring/_obj/
mkdir -p $WORK/code.google.com/p/gopacket/
cd /root/lib/golib/src/code.google.com/p/gopacket/pfring
CGO_LDFLAGS="-g" "-O2" "-lpfring" "-lpcap" "-lnuma" "-lrt" 
/root/lib/go/pkg/tool/linux_amd64/cgo -objdir 
$WORK/code.google.com/p/gopacket/pfring/_obj/ -- -I 
$WORK/code.google.com/p/gopacket/pfring/_obj/ pfring.go
/root/lib/go/pkg/tool/linux_amd64/6c -F -V -w -trimpath $WORK -I 
$WORK/code.google.com/p/gopacket/pfring/_obj/ -I /root/lib/go/pkg/linux_amd64 
-o $WORK/code.google.com/p/gopacket/pfring/_obj/_cgo_defun.6 -D GOOS_linux -D 
GOARCH_amd64 $WORK/code.google.com/p/gopacket/pfring/_obj/_cgo_defun.c
gcc -I . -fPIC -m64 -pthread -fmessage-length=0 -print-libgcc-file-name
gcc -I . -fPIC -m64 -pthread -fmessage-length=0 -I 
$WORK/code.google.com/p/gopacket/pfring/_obj/ -g -O2 -o 
$WORK/code.google.com/p/gopacket/pfring/_obj/_cgo_main.o -c 
$WORK/code.google.com/p/gopacket/pfring/_obj/_cgo_main.c
gcc -I . -fPIC -m64 -pthread -fmessage-length=0 -I 
$WORK/code.google.com/p/gopacket/pfring/_obj/ -g -O2 -o 
$WORK/code.google.com/p/gopacket/pfring/_obj/_cgo_export.o -c 
$WORK/code.google.com/p/gopacket/pfring/_obj/_cgo_export.c
gcc -I . -fPIC -m64 -pthread -fmessage-length=0 -I 
$WORK/code.google.com/p/gopacket/pfring/_obj/ -g -O2 -o 
$WORK/code.google.com/p/gopacket/pfring/_obj/pfring.cgo2.o -c 
$WORK/code.google.com/p/gopacket/pfring/_obj/pfring.cgo2.c
gcc -I . -fPIC -m64 -pthread -fmessage-length=0 -o 
$WORK/code.google.com/p/gopacket/pfring/_obj/_cgo_.o 
$WORK/code.google.com/p/gopacket/pfring/_obj/_cgo_main.o 
$WORK/code.google.com/p/gopacket/pfring/_obj/_cgo_export.o 
$WORK/code.google.com/p/gopacket/pfring/_obj/pfring.cgo2.o -g -O2 -lpfring 
-lpcap -lnuma -lrt
# code.google.com/p/gopacket/pfring
/usr/local/lib/libpfring.so: undefined reference to `pfring_mod_sysdig_open'
/usr/local/lib/libpfring.so: undefined reference to `read_silicom_ts'
/usr/local/lib/libpfring.so: undefined reference to 
`pfring_handle_ixia_hw_timestamp'
/usr/local/lib/libpfring.so: undefined reference to 
`pfring_read_ixia_hw_timestamp'
/usr/local/lib/libpfring.so: undefined reference to `is_silicom_ts_card'
collect2: error: ld returned 1 exit status


pfring_mod_sysdig_open, pfring_handle_ixia_hw_timestamp,... all seem to have 
been added to pfring recently.

What steps will reproduce the problem?
1. Setup windows golang environment
2. with winpcap developer pack 4.1.2
3. build a program

What is the expected output? What do you see instead?
{{{
# code.google.com/p/gopacket/layers
testproj\src\code.google.com\p\gopacket\layers\winsock.go:15: 
ProtocolFamilyIPv4 redeclared in this block
        previous declaration at testproj\src\code.google.com\p\gopacket\layers\enums.go:182
testproj\src\code.google.com\p\gopacket\layers\winsock.go:18: 
ProtocolFamilyIPv6BSD redeclared in this block
        previous declaration at testproj\src\code.google.com\p\gopacket\layers\enums.go:185
testproj\src\code.google.com\p\gopacket\layers\winsock.go:19: 
ProtocolFamilyIPv6FreeBSD redeclared in this block
        previous declaration at testproj\src\code.google.com\p\gopacket\layers\enums.go:186
testproj\src\code.google.com\p\gopacket\layers\winsock.go:20: 
ProtocolFamilyIPv6Darwin redeclared in this block
        previous declaration at testproj\src\code.google.com\p\gopacket\layers\enums.go:187
testproj\src\code.google.com\p\gopacket\layers\winsock.go:21: 
ProtocolFamilyIPv6Linux redeclared in this block
        previous declaration at testproj\src\code.google.com\p\gopacket\layers\enums.go:188
}}}

What version of the product are you using? On what operating system?
`go get code.google.com/p/gopacket`

Please provide any additional information below.

{{{
diff --git a/layers/winsock.go b/layers/winsock.go
index 9e716c8..66f9539 100644
--- a/layers/winsock.go
+++ b/layers/winsock.go
@@ -11,12 +11,3 @@ package layers
 // #include <WinSock.h>
 import "C"

-const (
-       ProtocolFamilyIPv4 ProtocolFamily = C.AF_INET
-       // BSDs use different values for INET6... glory be.  These values taken
-       // tcpdump 4.3.0.
-       ProtocolFamilyIPv6BSD     ProtocolFamily = 24
-       ProtocolFamilyIPv6FreeBSD ProtocolFamily = 28
-       ProtocolFamilyIPv6Darwin  ProtocolFamily = 30
-       ProtocolFamilyIPv6Linux   ProtocolFamily = 10
-)
}}}

I wrote an app that uses gopacket to capture and analyze some network traffic 
generated by another local application. It works fine on capture files 
generated from `tcpdump` on my machine, but it fails when I run it in live mode 
-- I just don't get any packets.

I boiled this down into an executable test case. It opens a pcap session, sets 
up a filter, sends a packet to 8.8.8.8's UDP discard port, and checks to see 
that it can hear itself. This test succeeds on Linux:

$ go test github.com/willglynn/gopacket-local-test --interface br0
ok      github.com/willglynn/gopacket-local-test    0.675s

...but fails on my Mac:

$ go test --short 
--- FAIL: TestCapture (1.02 seconds)
    gopacket_local_test.go:61: starting capture on interface "en0"
    gopacket_local_test.go:74: capturing on "en0"
    gopacket_local_test.go:95: 2014-05-27 10:33:19.930115476 -0500 CDT: packet sent
    gopacket_local_test.go:91: 2014-05-27 10:33:20.931371869 -0500 CDT: no packets received, timing out
FAIL
exit status 1
FAIL    github.com/willglynn/gopacket-local-test    1.256s

A `tcpdump` session I had running shows that the packet was, in fact, sent:

$ tcpdump -n -i en0 'port 9'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on en0, link-type EN10MB (Ethernet), capture size 65535 bytes
10:33:19.930126 IP 172.16.4.167.59296 > 8.8.8.8.9: UDP, length 26

I'm new to go, so please excuse my test case. I'm just happy I can reproduce 
this at all. My Mac is running 10.9 with a Homebrew-installed go:

$ go version
go version go1.2.2 darwin/amd64

The DecodingLayerParser example in doc.go has a minor error. This fixes it:


diff --git a/doc.go b/doc.go
index a60867f..aa128bd 100644
--- a/doc.go
+++ b/doc.go
@@ -291,9 +291,9 @@ the packet's information.  A quick example:
      err := parser.DecodeLayers(packetDat, &decoded)
      for _, layerType := range decoded {
        switch layerType {
-         case layers.LayerTypeIPv6:
-           fmt.Println("    IP4 ", ip4.SrcIP, ip4.DstIP)
          case layers.LayerTypeIPv4:
+           fmt.Println("    IP4 ", ip4.SrcIP, ip4.DstIP)
+         case layers.LayerTypeIPv6:
            fmt.Println("    IP6 ", ip6.SrcIP, ip6.DstIP)
        }
      }

It seems that layers.decodeName doesn't validate the dns packet well enough and 
in a badly crafted packet it can cause stack overflow.

code.google.com/p/gopacket/layers.decodeName(0xc209b1d24e, 0x6e, 0x6e, 0x4c, 
0xc209a40ca8, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
code.google.com/p/gopacket/layers/dns.go:297

gopacket/pcap is missing a few useful functions from the pcap C API. This is 
one of them.

Patch available at 
https://code.google.com/r/matthiasradestock-gopacket-pcap/source/detail?r=db5018
e114ecffa680ace6e2848191e6a30e9e44&name=pcap_setdirection

In https://code.google.com/p/gopacket/source/browse/layers/ip4.go, you have the 
code:

const (
        IPv4EvilBit       IPv4Flag = 1 << 0 // http://tools.ietf.org/html/rfc3514 ;)
        IPv4DontFragment  IPv4Flag = 1 << 1
        IPv4MoreFragments IPv4Flag = 1 << 2
)

func (ip *IPv4) SerializeTo(b gopacket.SerializeBuffer, opts 
gopacket.SerializeOptions) error {
        ...
        binary.BigEndian.PutUint16(bytes[6:], ip.flagsfrags())
        ...
}

func (ip *IPv4) flagsfrags() (ff uint16) {
        ff |= uint16(ip.Flags) << 13
        ff |= ip.FragOffset
        return
}

Unfortunately, this is wrong. The shift <<13 is correct, but your order of the 
flags is wrong. As http://en.wikipedia.org/wiki/IPv4#Header says:
"Flags 
A three-bit field follows and is used to control or identify fragments. They 
are (in order, from high order to low order):
bit 0: Reserved; must be zero.[note 1]
bit 1: Don't Fragment (DF)
bit 2: More Fragments (MF)"

The crucial bit is "high to low". I.e. bit 0 is actually the top bit in byte 6 
of the header. Thus you serialise MoreFrags to the top bit, when it should be 
the lowest bit. If you try to generate a packet and then decode it in wireshark 
or equiv with MoreFrags set, it will show you you've actually set the EvilBit.

The DecodeFromBytes is also wrong in the same way.

What steps will reproduce the problem?
1. Create a new workspace.
2. go get code.google.com/p/gopacket
3. go install ./...

What is the expected output? What do you see instead?
Expected output is that everything builds.  Instead, I see:

# code.google.com/p/gopacket/layers
src/code.google.com/p/gopacket/layers/mpls.go:36: undefined: 
gopacket.ValidMACPrefixMap

What version of the product are you using? On what operating system?
Version: 32896eb
OS: Linux 3.9.9-1-ARCH x86_64 GNU/Linux

What steps will reproduce the problem?
1. Use the latest version of libpcap (1.5.3)
2. Create a handle with OpenLive()
3. Set a filter on handler with SetBPFFilter()

What is the expected output? What do you see instead?

The filter should be applied. Instead, SetBPFFilter returns the error

    not-yet-activated pcap_t passed to pcap_compile

What version of the product are you using? On what operating system?

This occurs using libpcap 1.5.3 on Ubuntu 12.04

Please provide any additional information below.

The handle needs to be activated first. Here is the one line fix

https://gist.github.com/kyleconroy/9364253#file-bpf-go-L3

Hello :)

I hack gopacket again and hit new bugs :)

Please take a look on this code https://play.golang.org/p/Bcb2ESD3SE

I got this errors:
PACKET: 80 bytes, wire length 80 cap length 80 @ 2014-10-14 13:00:05.04175 
+0400 MSK
- Layer 1 (14 bytes) = Ethernet {Contents=[..14..] Payload=[..66..] 
SrcMAC=00:0f:35:bb:0b:40 DstMAC=00:22:19:b6:7e:22 EthernetType=IPv4 Length=0}
- Layer 2 (20 bytes) = IPv4 {Contents=[..20..] Payload=[..46..] Version=4 IHL=5 
TOS=0 Length=66 Id=11235 Flags= FragOffset=0 TTL=53 Protocol=UDP Checksum=26611 
SrcIP=212.93.97.149 DstIP=95.211.92.15 Options=[] Padding=[]}
- Layer 3 (08 bytes) = UDP  {Contents=[..8..] Payload=[..38..] 
SrcPort=2294(konshus-lm) DstPort=53(domain) Length=46 Checksum=36534}
- Layer 4 (38 bytes) = DecodeFailure    Packet decoding error: runtime error: 
slice bounds out of range

After this. I disabled recover() function for detailed traceback and got it:
./dns_sniffer 
panic: runtime error: slice bounds out of range

goroutine 20 [running]:
runtime.panic(0x588a00, 0x931eaf)
    /usr/local/go/src/pkg/runtime/panic.c:279 +0xf5
code.google.com/p/gopacket/layers.decodeName(0xc20800420a, 0x27, 0x27, 0x1c, 
0xc209070168, 0x0, 0x0, 0x0, 0x608011970, 0x0, ...)
    /root/gocode/src/code.google.com/p/gopacket/layers/dns.go:363 +0x4f8
code.google.com/p/gopacket/layers.(*DNSResourceRecord).decode(0xc208044280, 
0xc20800420a, 0x27, 0x27, 0x1c, 0x7f8af23581a0, 0xc208003440, 0xc209070168, 
0x1c, 0x0, ...)
    /root/gocode/src/code.google.com/p/gopacket/layers/dns.go:427 +0x86
code.google.com/p/gopacket/layers.(*DNS).DecodeFromBytes(0xc2090700c0, 
0xc20800420a, 0x27, 0x27, 0x7f8af23581a0, 0xc208003440, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/layers/dns.go:267 +0xe5b
code.google.com/p/gopacket/layers.decodeDNS(0xc20800420a, 0x27, 0x27, 
0x7f8af2358138, 0xc208003440, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/layers/dns.go:193 +0xe4
code.google.com/p/gopacket.DecodeFunc.Decode(0x63e8f8, 0xc20800420a, 0x27, 
0x27, 0x7f8af2358138, 0xc208003440, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/decode.go:84 +0x6b
code.google.com/p/gopacket.LayerType.Decode(0x6b, 0xc20800420a, 0x27, 0x27, 
0x7f8af2358138, 0xc208003440, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/layertype.go:85 +0xef
code.google.com/p/gopacket.(*eagerPacket).NextDecoder(0xc208003440, 
0x7f8af23582e0, 0x6b, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/packet.go:347 +0x20c
code.google.com/p/gopacket/layers.decodeUDP(0xc208004202, 0x2f, 0x2f, 
0x7f8af2358138, 0xc208003440, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/layers/udp.go:104 +0x22b
code.google.com/p/gopacket.DecodeFunc.Decode(0x63ebb0, 0xc208004202, 0x2f, 
0x2f, 0x7f8af2358138, 0xc208003440, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/decode.go:84 +0x6b
code.google.com/p/gopacket.LayerType.Decode(0x2d, 0xc208004202, 0x2f, 0x2f, 
0x7f8af2358138, 0xc208003440, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/layertype.go:85 +0xef
code.google.com/p/gopacket.(*eagerPacket).NextDecoder(0xc208003440, 
0x7f8af23582e0, 0x2d, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/packet.go:347 +0x20c
code.google.com/p/gopacket/layers.decodeIPv4(0xc2080041ee, 0x43, 0x43, 
0x7f8af2358138, 0xc208003440, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/layers/ip4.go:212 +0x22b
code.google.com/p/gopacket.DecodeFunc.Decode(0x63eac8, 0xc2080041ee, 0x43, 
0x43, 0x7f8af2358138, 0xc208003440, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/decode.go:84 +0x6b
code.google.com/p/gopacket/layers.EthernetType.Decode(0x800, 0xc2080041ee, 
0x43, 0x43, 0x7f8af2358138, 0xc208003440, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/layers/enums.go:286 +0x9b
code.google.com/p/gopacket/layers.EthernetType.Decode·i(0x800, 0xc2080041ee, 
0x43, 0x43, 0x7f8af2358138, 0xc208003440, 0x0, 0x0)
    <autogenerated>:8 +0x78
code.google.com/p/gopacket.(*eagerPacket).NextDecoder(0xc208003440, 
0x7f8af2358240, 0x800, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/packet.go:347 +0x20c
code.google.com/p/gopacket/layers.decodeEthernet(0xc2080041e0, 0x51, 0x51, 
0x7f8af2358138, 0xc208003440, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/layers/ethernet.go:121 +0x21d
code.google.com/p/gopacket.DecodeFunc.Decode(0x63ea80, 0xc2080041e0, 0x51, 
0x51, 0x7f8af2358138, 0xc208003440, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/decode.go:84 +0x6b
code.google.com/p/gopacket/layers.LinkType.Decode(0x7f8af44e9001, 0xc2080041e0, 
0x51, 0x51, 0x7f8af2358138, 0xc208003440, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/layers/enums.go:316 +0x9b
code.google.com/p/gopacket/layers.LinkType.Decode·i(0x1, 0xc2080041e0, 0x51, 
0x51, 0x7f8af2358138, 0xc208003440, 0x0, 0x0)
    <autogenerated>:3 +0x77
code.google.com/p/gopacket.(*eagerPacket).initialDecode(0xc208003440, 
0x7f8af2358110, 0x1)
    /root/gocode/src/code.google.com/p/gopacket/packet.go:351 +0xb3
code.google.com/p/gopacket.NewPacket(0xc2080041e0, 0x51, 0x51, 0x7f8af2358110, 
0x1, 0x28470000, 0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/packet.go:566 +0x2bc
code.google.com/p/gopacket.(*PacketSource).NextPacket(0xc209062450, 0x0, 0x0, 
0x0, 0x0)
    /root/gocode/src/code.google.com/p/gopacket/packet.go:664 +0x153
code.google.com/p/gopacket.(*PacketSource).packetsToChannel(0xc209062450)
    /root/gocode/src/code.google.com/p/gopacket/packet.go:677 +0x4c
created by code.google.com/p/gopacket.(*PacketSource).Packets
    /root/gocode/src/code.google.com/p/gopacket/packet.go:700 +0x5f

goroutine 16 [runnable]:
main.main()
    /root/gocode/dns_sniffer.go:14 +0x260

goroutine 19 [finalizer wait]:
runtime.park(0x4156f0, 0x9414b8, 0x934149)
    /usr/local/go/src/pkg/runtime/proc.c:1369 +0x89
runtime.parkunlock(0x9414b8, 0x934149)
    /usr/local/go/src/pkg/runtime/proc.c:1385 +0x3b
runfinq()
    /usr/local/go/src/pkg/runtime/mgc0.c:2644 +0xcf
runtime.goexit()
    /usr/local/go/src/pkg/runtime/proc.c:1445

goroutine 17 [syscall]:
runtime.goexit()
    /usr/local/go/src/pkg/runtime/proc.c:1445

pcap can't replay packets with WritePacketData because of the way pcap is 
initialized in OpenLive. I've switched that pcap_create and subsequent code 
with pcap_open_live() and WritePacketData worked as expected.

Hi,

On OSX 10.9.4 with Go 1.3 I'm trying to

$ go get code.google.com/p/gopacket/pcap

But it is failing with the following error:

38: error: use of undeclared identifier '__suseconds_t'; did you mean 
'suseconds_t'?
38: error: use of undeclared identifier '__time_t'; did you mean 'time_t'?

Does anybody know what causes this?

Thanks,

Ben

You can pull these changes from 
https://code.google.com/r/attilaolah-gopacket/source/list?name=documentation 
— I fixed a few typos in the documentation:

diff --git a/doc.go b/doc.go
index d6481d6..a60867f 100644
--- a/doc.go
+++ b/doc.go
@@ -86,7 +86,7 @@ packetSource.DecodeOptions... see the following sections for 
more details.
 Lazy Decoding

 gopacket optionally decodes packet data lazily, meaning it
-only decodes a packet layer when it needs to to handle a function call.
+only decodes a packet layer when it needs to handle a function call.

  // Create a packet, but don't actually decode anything yet
  packet := gopacket.NewPacket(myPacketData, layers.LayerTypeEthernet, gopacket.Lazy)
@@ -123,8 +123,8 @@ gopacket.NewPacket, and it'll use the passed-in slice 
itself.
  }

 The fastest method of decoding is to use both Lazy and NoCopy, but note from
-the many caveats above that for some implementations they may be dangerous
-either or both may be dangerous.
+the many caveats above that for some implementations either or both may be
+dangerous.


 Pointers To Known Layers

What steps will reproduce the problem?
1. Create a GRE packet where checksum present bit is not set but sequence bit 
is set
2. Pass the packet to DecodeFromBytes
3. The decode sequence number is incorrect

What is the expected output? What do you see instead?
The sequence number is incorrect.  It appears that the next layer's data is 
used.

What version of the product are you using? On what operating system?
Ubuntu 14.04

Please provide any additional information below.
According to RFC 2784, checksum and reserved1/offset will not be present if 
checksum present field is not set.  However, this is not what is being coded.

pcap.SetBPFFilter always fail on a Handler that was created by 
pcap.OpenOffline. It fails on the call to C.pcap_lookupnet because the device 
name passed to it is an empty string.

Besides this, the httpassembly example has a duplicate message about capturing 
from interface even when using -r to capture from file, and crashes at the end 
of the capture because of a nil packet. That nil packet actually indicates the 
end of the capture.

Here's the patch: https://gist.github.com/fiorix/433bd0bd8e74c3933a1f

Feel free to remove my comments and adjust as necessary.

Hello!

I'm correctly installed pf_ring kernel module and it works perfectly (I checked 
it using pf_ring distribution examples).

But I can't work with PF_RING from go because I got error:
./test 
panic: pfring NewRing error: operation not supported

goroutine 1 [running]:
runtime.panic(0x521aa0, 0xc2110712f0)
    /usr/lib/golang/src/pkg/runtime/panic.c:266 +0xb6
main.main()
    /root/tests_pf_ring/test.go:13 +0x8c

goroutine 3 [syscall]:
runtime.goexit()
    /usr/lib/golang/src/pkg/runtime/proc.c:1394


Here I can provide source code:
package main

import "code.google.com/p/gopacket"
import "code.google.com/p/gopacket/layers"
import "code.google.com/p/gopacket/pfring"
import "fmt"

func main() {
 ring, err := pfring.NewRing("eth0", 128, 0)

 if err != nil {
   panic(err)
 }


  packetSource := gopacket.NewPacketSource(ring, layers.LayerTypeEthernet)
     for packet := range packetSource.Packets() {
     //handlePacket(packet)  // Do something with a packet here.
    fmt.Println(packet)
   }

    fmt.Println( "Hello" )
    return
}

My platform:
go version
go version go1.2.2 linux/amd64

Please help me :(

Branch name: bgreen/sflow

Purpose of code changes on this branch:

Adds decoding layer for SFlow version 5. It includes the more widely-used 
sample types. Some sample types are not supported.

When reviewing my code changes, please focus on:

It's not very complicated code, so I guess just be sure it follows the overall 
philosophy and has good style, etc. I'm not a developer, so I'm sure it has 
some issues.

After the review, I'll merge this branch into:

Not sure about this... I'll leave the merge up to you if possible.