-
-
Notifications
You must be signed in to change notification settings - Fork 68
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #12 from negbie/master
Add new flags to write pcap files
- Loading branch information
Showing
6 changed files
with
175 additions
and
25 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,145 @@ | ||
| package sniffer | ||
|
|
||
| import ( | ||
| "compress/gzip" | ||
| "fmt" | ||
| "io" | ||
| "os" | ||
| "os/signal" | ||
| "path/filepath" | ||
| "syscall" | ||
| "time" | ||
|
|
||
| "github.com/google/gopacket" | ||
| "github.com/google/gopacket/pcapgo" | ||
| "github.com/negbie/heplify/logp" | ||
| ) | ||
|
|
||
| type pcapWriter interface { | ||
| WritePacket(ci gopacket.CaptureInfo, data []byte) error | ||
| Close() error | ||
| } | ||
|
|
||
| type defaultPcapWriter struct { | ||
| io.WriteCloser | ||
| *pcapgo.Writer | ||
| } | ||
|
|
||
| type gzipPcapWriter struct { | ||
| w io.WriteCloser | ||
| z *gzip.Writer | ||
| *pcapgo.Writer | ||
| } | ||
|
|
||
| func (wrapper *gzipPcapWriter) Close() error { | ||
| gzerr := wrapper.z.Close() | ||
| ferr := wrapper.w.Close() | ||
|
|
||
| if gzerr != nil { | ||
| return gzerr | ||
| } | ||
| if ferr != nil { | ||
| return ferr | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func (sniffer *SnifferSetup) createPcap(baseFilename string) (pcapWriter, error) { | ||
| if sniffer.config.ZipPcap { | ||
| baseFilename = baseFilename + ".gz" | ||
| } | ||
| logp.Info("opening new pcap file %s", baseFilename) | ||
| f, err := os.Create(baseFilename) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| if sniffer.config.ZipPcap { | ||
| o := gzip.NewWriter(f) | ||
| w := pcapgo.NewWriter(o) | ||
| w.WriteFileHeader(uint32(sniffer.config.Snaplen), sniffer.Datalink()) | ||
| return &gzipPcapWriter{f, o, w}, nil | ||
| } | ||
|
|
||
| w := pcapgo.NewWriter(f) | ||
| // It's a new file, so we need to create a new writer | ||
| w.WriteFileHeader(uint32(sniffer.config.Snaplen), sniffer.Datalink()) | ||
| return &defaultPcapWriter{f, w}, nil | ||
|
|
||
| } | ||
|
|
||
| func (sniffer *SnifferSetup) movePcap(tempName, outputPath string) error { | ||
| dateString := time.Now().Format("2006/01/02/02.01.2006T15:04:05.pcap") | ||
| if sniffer.config.ZipPcap { | ||
| dateString = dateString + ".gz" | ||
| tempName = tempName + ".gz" | ||
| } | ||
|
|
||
| newName := filepath.Join(outputPath, dateString) | ||
| // Make sure that the directory exists | ||
| if err := os.MkdirAll(filepath.Dir(newName), 0777); err != nil { | ||
| return err | ||
| } | ||
| err := os.Rename(tempName, newName) | ||
|
|
||
| if err != nil && !os.IsNotExist(err) { | ||
| return err | ||
| } | ||
| if err == nil { | ||
| logp.Info("moved %s to %s", tempName, newName) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func (sniffer *SnifferSetup) dumpPcap() { | ||
| outPath := sniffer.config.WriteFile | ||
| tmpName := fmt.Sprintf("%s_interface.pcap.tmp", sniffer.config.Device) | ||
|
|
||
| signals := make(chan os.Signal, 2) | ||
| signal.Notify(signals, os.Interrupt, syscall.SIGTERM) | ||
| ticker := time.NewTicker(time.Duration(sniffer.config.RotationTime) * time.Minute) | ||
|
|
||
| // Move and rename any leftover pcap files from a previous run | ||
| sniffer.movePcap(tmpName, outPath) | ||
|
|
||
| w, err := sniffer.createPcap(tmpName) | ||
| if err != nil { | ||
| logp.Err("Error opening pcap: %v", err) | ||
| } | ||
|
|
||
| for { | ||
| select { | ||
| case packet := <-sniffer.chPcapDumper: | ||
| err := w.WritePacket(packet.ci, packet.data) | ||
| if err != nil { | ||
| w.Close() | ||
| logp.Err("Error writing output pcap: %v", err) | ||
| } | ||
|
|
||
| case <-ticker.C: | ||
| err = w.Close() | ||
| if err != nil { | ||
| logp.Err("Error closing pcap: %v", err) | ||
| } | ||
| err = sniffer.movePcap(tmpName, outPath) | ||
| if err != nil { | ||
| logp.Err("Error renaming pcap: %v", err) | ||
| } | ||
| w, err = sniffer.createPcap(tmpName) | ||
| if err != nil { | ||
| logp.Err("Error opening pcap: %v", err) | ||
| } | ||
|
|
||
| case <-signals: | ||
| logp.Info("Received stop signal") | ||
| err = w.Close() | ||
| if err != nil { | ||
| logp.Err("Error Closing: %v", err) | ||
| } | ||
| err = sniffer.movePcap(tmpName, outPath) | ||
| if err != nil { | ||
| logp.Err("Error renaming pcap: %v", err) | ||
| } | ||
| os.Exit(0) | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters