goshark

goshark is a Go library that leverages the tshark command-line tool to decode IP packets from capture files (like PCAP) and convert them into structured Go data types. This enables programmatic analysis of network traffic, making it easier to extract and inspect protocol fields without manual parsing.

Key Features

• tshark Integration — Utilizes the powerful tshark dissector to decode a wide range of network protocols.
• Structured Data Output — Converts raw packet data into Go structs for easy access and manipulation.
• Streaming Packet Processing — Provides methods to iterate through packets sequentially from a capture file.
• Field Lookup — Allows querying specific protocol fields (e.g., igmp.maddr) from decoded packets.

Philosophy

goshark aims to bridge the gap between raw packet captures and Go applications by providing a clean, programmatic interface to tshark's decoding capabilities.