pcap.CompileBPFFilter DLT/LINKTYPE confusion
- Dominant language
- Go
- Stars
- 6.8k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
`pcap.CompileBPFFilter` claims to accept `layers.LinkType` type, which corresponds to `LINKTYPE_*` constants in libpcap.
This is unfortunately wrong, as libpcap actually expects `DLT_*` constants here.
For example, trying to pass `layers.LinkTypeRaw` results in `unknown data link type 101` (`LINKTYPE_RAW`) error. You should pass pass 12 here (`DLT_RAW`).
```go
package main
import (
"fmt"
"github.com/google/gopacket/layers"
"github.com/google/gopacket/pcap"
)
func main() {
for _, linkType := range []layers.LinkType{layers.LinkType(12), layers.LinkTypeRaw} {
_, err := pcap.CompileBPFFilter(linkType, 0x10000, "tcp port 80")
fmt.Printf("%s (val=%d) err=%v\n", linkType, linkType, err)
}
}
```
```
Raw (val=12) err=
Raw (val=101) err=unknown data link type 101
```
Contributor guide
Assessment
This issue has not been assessed yet.