google/gopacket
Gopacket
gopacket is a Go library for live packet capture and multi-layer protocol decoding. It provides a framework for parsing raw network bytes into structured protocol layers, enabling inspection and analysis of network traffic directly from interfaces or packet capture files.
The library distinguishes itself through a layered protocol stack that organizes decoders as independent, composable layers, and an interface-based decoder registry that supports extensible custom protocol development. It offers zero-copy packet decoding for high-throughput parsing, stream-based TCP reassembly to reconstruct ordered application data from out-of-order segments, and buffer-pooled memory management to reduce garbage collection pressure during capture. Packet processing is decode-only, preserving original raw bytes for forensic workflows.
gopacket supports live traffic capture via platform-specific backends like AF_PACKET on Linux and pcap on BSD/macOS, and enables network forensics investigation, packet analysis automation, and structured inspection of network traffic.
Features
- Go Libraries - Provides a Go library for decoding and manipulating network packets at multiple protocol layers.
- Live Capture Libraries - Sniffs packets directly from network interfaces using platform-specific capture libraries for real-time monitoring.
- Framework-Based Decoders - Provides a framework for parsing raw bytes into structured protocol layers and custom protocol development.
- Network Packet Parsers - Parses raw network bytes into structured protocol layers for inspection and analysis in Go applications.
- Cross-Platform Captures - Sniffs network packets directly from interfaces using platform-specific capture libraries like libpcap.
- Unified Capture APIs - Provides a unified Go API for live packet capture across Linux AF_PACKET and BSD/macOS pcap.
- Decode-Only Processors - Provides decode-only packet processing that preserves raw bytes for forensic analysis.
- Layered Decoder Stacks - Organises protocol decoders as a stack of independent layers for flexible packet header traversal.
- TCP Stream Reassembly - Reconstructs ordered application data from out-of-order TCP segments using sequence number tracking.
- Network Forensics - Analyzes captured packet data from files or live interfaces to investigate network events and security incidents.
- Zero-Copy Parsing - Decodes network packets directly from raw byte buffers without intermediate copying for high throughput.
- Interface-Based Registries - Ships an interface-based decoder registry for extensible custom protocol development.
- Packet Analysis Tools - Enables building automated tools that process, filter, and inspect network packets programmatically in Go.
- Networking Libraries - Library for packet processing.
- Networking - Packet processing library with libpcap bindings.
- Netzwerk-Bibliotheken - Library for packet processing.
