Reading from a pcap file

Instead of opening a device for live capture, you can also open a pcap file for inspection offline. After getting a handle, whether it was from pcap.OpenLive() or pcap.OpenOffline(), the handle is treated the same. No distinction is made between a live device and a capture file once the handle is created, except that a live device will continue to deliver packets, and a file will eventually end.

You can read pcap files that were captured with any libpcap client, including Wireshark, tcpdump, or other gopacket applications. This example opens a file named test.pcap using pcap.OpenOffline() and then iterates through the packets using range and prints the basic packet information. Change the filename from test.pcap

Get Security with Go now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.