Security with Go

Saving to the pcap file

This program will perform a packet capture and store the results in a file. The important step in this example is the call to the pcapgo package—the WriteFileHeader() function of Writer. After that, the WritePacket() function can be used to write the desired packets to a file. You can capture all the traffic and choose to write only specific packets based on your own filtering criteria, if desired. Perhaps you only want to write odd or malformed packets to log anomalies.

To do the equivalent with tcpdump, just pass it the -w flag with a filename, as shown in the following command:

tcpdump -i eth0 -w my_capture.pcap

The pcap files created with this example can be opened with Wireshark and viewed just like files created ...