Security with Go

Reading from a pcap file

Instead of opening a device for live capture, you can also open a pcap file for inspection offline. After getting a handle, whether it was from pcap.OpenLive() or pcap.OpenOffline(), the handle is treated the same. No distinction is made between a live device and a capture file once the handle is created, except that a live device will continue to deliver packets, and a file will eventually end.

You can read pcap files that were captured with any libpcap client, including Wireshark, tcpdump, or other gopacket applications. This example opens a file named test.pcap using pcap.OpenOffline() and then iterates through the packets using range and prints the basic packet information. Change the filename from test.pcap