0

I'm working on detecting NTP using golang and the gopacket package. I'm using a pcap I downloaded from wireshark. I've got the following code for opening PCAPs and handling them :

func (d *DPI) readPCAP(pcapFile string) (*pcap.Handle, error) {
    // Open file instead of device
    handle, err := pcap.OpenOffline(pcapFile)
    if err != nil {
        return nil, err
    }
    return handle, nil
}

And this is the code I'm writing to perform the actual detection

func TestNTP(t *testing.T) {



    dpi := newDPI()
    handle, _ := dpi.readPCAP("data/pcap/NTP_sync.pcap")

    var filter = "udp and port 123"
    dpi.setFilter(handle,filter)
    ntpPackets := 0

    for packet := range dpi.getPacketChan(handle) {
        fmt.Println("stuff: ",packet.ApplicationLayer().Payload())
        if dpi.detectNTP(packet) == 1 {
            ntpPackets++
        } else {
            fmt.Println(" Output : ", dpi.detectNTP(packet))
        }
    }
    fmt.Println(" Total ntp packets ", ntpPackets)


}

The Payload content in the ApplicationLayer is coming up empty and I'm unable to figure out why this is happening.

Example screenshot when I print out the ApplicationLayer itself :

https://i.gyazo.com/6257f298a09e7403bbc0be5b8ac84ccc.png

Example screenshot when I print out the Payload : https://i.gyazo.com/7f4abd449025f5d65160fdbecffa8181.png

Could use some help figuring out what I'm doing wrong. Thanks!

Anirudh Singh
  • 31
  • 2
  • I notice that you're ignoring the potential error returned from ReadPCAP. Please rethink that. So many problems could be avoided if people would handle their error returns. – Zan Lynx Mar 15 '17 at 16:06
  • @ZanLynx Yeah, I need to do that. This was just for testing purposes. Thanks for the tip! – Anirudh Singh Mar 15 '17 at 16:12
  • Please include text output as text instead of an image (I assume that is why you got a downvote). – Jan Zerebecki Jul 10 '17 at 12:09

1 Answers1

1

Reading through the golang soure code, I came across this :

// NTP packets do not carry any data payload, so the empty byte slice is retured.
// In Go, a nil slice is functionally identical to an empty slice, so we
// return nil to avoid a heap allocation.
func (d *NTP) Payload() []byte {
    return nil
}

So, apparently it's not supposed to carry a Payload. I've managed to perform the detection using layers.

Anirudh Singh
  • 31
  • 2