// This function gets the interface and configuration parameters from the core process // and starts handling packets that are captured with gopacket.pcap func (g *GPCapture) CaptureInterface(snapLen int32, promiscMode bool, bpfFilterString string, threadTerminationChan chan string, iwg *sync.WaitGroup) { go func() { defer g.CaptureDefer(threadTerminationChan) var ( err error packetSource *gopacket.PacketSource ) SysLog.Info(g.iface+": setting up capture") // loopback does not support in/out-bound filters, thus ignore it if g.iface == "lo" { SysLog.Err(g.iface+": interface not supported") iwg.Done() return } // open packet stream from an interface if g.pcapHandle, err = pcap.OpenLive(g.iface, snapLen, promiscMode, 250*time.Millisecond); err != nil { SysLog.Err(g.iface+": could not open capture: "+err.Error()) iwg.Done() return } // set the BPF filter. This has to be done in order to ensure that the link // type is identified correctly if e := g.pcapHandle.SetBPFFilter(bpfFilterString); e != nil { SysLog.Err(g.iface+": error setting BPF filter: " + e.Error()) iwg.Done() return } SysLog.Debug(g.iface+": bpf set") // return from function in case the link type is zero (which can happen if the // specified interface does not exist (anymore)) if g.pcapHandle.LinkType() == layers.LinkTypeNull { SysLog.Err(g.iface+": link type is null") iwg.Done() return } SysLog.Debug(g.iface+": link type: "+g.pcapHandle.LinkType().String()) // specify the pcap as the source from which the packets will be read packetSource = gopacket.NewPacketSource(g.pcapHandle, g.pcapHandle.LinkType()) // set the decoding options to lazy decoding in order to ensure that the packet // layers are only decoded once they are needed. Additionally, this is imperative // when GRE-encapsulated packets are decoded because otherwise the layers cannot // be detected correctly. Additionally set the link type for this interface packetSource.DecodeOptions = gopacket.Lazy g.linkType = int(g.pcapHandle.LinkType()) SysLog.Debug(g.iface+": set packet source") iwg.Done() // perform the actual packet capturing: g.ReadPackets(packetSource) }() }