google/gopacket
Gopacket
gopacket is a Go library for live packet capture and multi-layer protocol decoding. It provides a framework for parsing raw network bytes into structured protocol layers, enabling inspection and analysis of network traffic directly from interfaces or packet capture files.
The library distinguishes itself through a layered protocol stack that organizes decoders as independent, composable layers, and an interface-based decoder registry that supports extensible custom protocol development. It offers zero-copy packet decoding for high-throughput parsing, stream-based TCP reassembly to reconstruct ordered application data from out-of-order segments, and buffer-pooled memory management to reduce garbage collection pressure during capture. Packet processing is decode-only, preserving original raw bytes for forensic workflows.
gopacket supports live traffic capture via platform-specific backends like AF_PACKET on Linux and pcap on BSD/macOS, and enables network forensics investigation, packet analysis automation, and structured inspection of network traffic.