Native Go Packet Capture, tcpdump-style cBPF Compilation, CGO-free Cross Builds

中文文档 · Documentation · Examples

---

What is Go-Pcap

Go-Pcap is a native Go packet-capture library and tcpdump-style cBPF filter compiler. It provides a libpcap-like capture surface without CGO, making CGO_ENABLED=0 builds and cross-compilation straightforward.

Key Features

• Native Go Packet Capture: Provides a libpcap-like capture API without requiring CGO.
• tcpdump-style Filters: Compiles common protocol, host, network, port, and logical expressions to cBPF.
• Ethernet and Raw IP: Supports both Ethernet (EN10MB) and raw IP (RAW) packet layouts.
• Protocol Coverage: Supports IPv4, IPv6, ARP/RARP, TCP, UDP, ICMP, ICMP6, IGMP, PIM, ESP, AH, VRRP, VLAN, and MPLS traffic.
• Packet Capture CLI: Prints tcpdump-style summaries and supports commonly used tcpdump display options.
• Cross Compilation: Builds with CGO_ENABLED=0 for supported Linux and macOS/Darwin targets.

Getting Started

Install Go-Pcap in your Go module:

go get github.com/huatuo-ai/go-pcap@latest

See the examples for library usage and the documentation for detailed guides.

Filter Language

Capability	Example
Protocol and port	tcp and port 443
Direction and range	src portrange 1000-2000
IPv6	ip6 and udp and port 53
Packet fields	tcp[tcpflags] & (tcp-syn|tcp-ack) == (tcp-syn|tcp-ack)
Encapsulation	vlan 100 and tcp port 443, mpls and ip
Logical expressions	tcp and port 80 or udp, not (tcp or udp)

See the filter language guide for more details.

Platform Support

Platform	Capture Support	Notes
Linux	Supported	Uses AF_PACKET and requires packet-capture privileges
macOS/Darwin	Supported	Requires packet-capture privileges

Documentation

For more information, visit the Go-Pcap documentation.

Contributing

Issues and pull requests are welcome, especially for new protocol support, link types, compatibility cases, and performance work.

See CONTRIBUTING.md for local checks and pull-request expectations. The documentation includes deeper guides for the architecture, compiler internals, and new filter primitives.

License

Go-Pcap is derived from packetcap/go-pcap and is open source under the Apache License 2.0.