Files
akvorado/common/helpers/tests_pcap.go
Vincent Bernat f8a795282e inlet/flow: replace raw data test files with PCAP files
Raw data files can be converted with Scapy:

```python
from scapy.all import *
wrpcap("data-1140.pcap",
  Ether(src="00:53:00:11:22:33",dst="00:53:00:44:55:66")/
  IP(src="192.0.2.100", dst="192.0.2.101")/
  UDP(sport=47873,dport=6343)/
  open("data-1140.data", "rb").read())
```
2022-09-09 13:55:09 +02:00

38 lines
890 B
Go

// SPDX-FileCopyrightText: 2022 Free Mobile
// SPDX-License-Identifier: AGPL-3.0-only
//go:build !release
package helpers
import (
"bytes"
"os"
"testing"
"github.com/google/gopacket"
"github.com/google/gopacket/layers"
"github.com/google/gopacket/pcapgo"
)
// ReadPcapPayload reads and parses a PCAP file and return the payload (after Layer 4).
func ReadPcapPayload(t *testing.T, pcapfile string) []byte {
t.Helper()
f, err := os.Open(pcapfile)
if err != nil {
t.Fatalf("Open(%q) error:\n%+v", pcapfile, err)
}
defer f.Close()
reader, err := pcapgo.NewReader(f)
if err != nil {
t.Fatalf("NewReader(%q) error:\n%+v", pcapfile, err)
}
payload := bytes.NewBuffer([]byte{})
source := gopacket.NewPacketSource(reader, layers.LayerTypeEthernet)
for packet := range source.Packets() {
payload.Write(packet.TransportLayer().LayerPayload())
}
return payload.Bytes()
}