0

Im trying to fast parse packet layers using the following offical example https://youtu.be/APDnbmTKjgM?t=1135

    var ip4 layers.IPv4
    var tcp layers.TCP
    var udp layers.UDP
    var sip layers.SIP
    parser := gopacket.NewDecodingLayerParser(layers.LayerTypeIPv4, &ip4, &tcp, &udp, &sip)
    decodedLayers := []gopacket.LayerType{}
    // ...
    packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
    for packet := range packetSource.Packets() {
        parser.DecodeLayers(packet.Data(), &decodedLayers)
        for _, layerType := range decodedLayers {
            fmt.Println(layerType) // prints nothing/ seems program doesn't iterate at all
        }

but this example doesnt work. For comparsion another usual approach - iterate over packet.Layers() works correctly.

What do i wrong with gopacket.NewDecodingLayerParser approach?

Full code:

package main

import (
    "fmt"
    "log"
    "strings"
    "time"

    "github.com/google/gopacket"
    "github.com/google/gopacket/layers"
    "github.com/google/gopacket/pcap"
)

func main() {
    var ip4 layers.IPv4
    var tcp layers.TCP
    var udp layers.UDP
    var sip layers.SIP
    parser := gopacket.NewDecodingLayerParser(layers.LayerTypeIPv4, &ip4, &tcp, &udp, &sip)
    decodedLayers := []gopacket.LayerType{}
    // get devices
    devices, err := pcap.FindAllDevs()
    if err != nil {
        log.Fatal(err)
    }

    var device pcap.Interface
    // look for "any" device
    for i := range devices {
        if strings.Contains(devices[i].Name, "any") {
            device = devices[i]
            log.Printf("%+v\n", device)
            break
        }
    }
    // start listening to "any" device
    handle, err := pcap.OpenLive(device.Name, int32(65535), false, -1*time.Second)
    if err != nil {
        log.Println(err)
    }
    defer handle.Close()
    // set filters
    handle.SetBPFFilter("(udp or tcp) and port 5060")
    // read loop
    packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
    for packet := range packetSource.Packets() {
        parser.DecodeLayers(packet.Data(), &decodedLayers)
        for _, layerType := range decodedLayers {
            fmt.Println(layerType) // prints nothing and seems program doesn't iterate at all
        }

        // other approach - is to iterate over packet.Layers():
        //for _, layer := range packet.Layers() {
        // fmt.Println(string(layer.LayerPayload())) // prints payload
        // }
    }
}
kostya
  • 27
  • 7
  • 2
    `parser.DecodeLayers` returns an error, which you are ignoring. Try handling the error to see if something is wrong there – blackgreen Nov 10 '21 at 12:53
  • "it does not work" is not a problem statement in that the only response one could sensibly give to it is "so there exists some problem", which is not too useful. – kostix Nov 10 '21 at 12:58
  • @blackgreen thank you, that was the point – kostya Nov 10 '21 at 13:25

0 Answers0