gopacket Dot11層を解析しています

Question

私はgpacketを使って.pcapファイルのパケットを解析しようとしていますが、これまでの情報やエラーを取得するまで、すべての情報を取得しています。フィルタ。

package main 

import (
    "fmt" 
    "github.com/google/gopacket" 
    "github.com/google/gopacket/pcap" 
    //"github.com/google/gopacket/layers" 
    "log" 
) 

var (
    pcapFile string = "myFile.pcap" 
    handle *pcap.Handle 
    err  error 
) 

func main() { 
    // Open file instead of device 
    handle, err = pcap.OpenOffline(pcapFile) 
    if err != nil { log.Fatal(err) } 
    defer handle.Close() 

    // Loop through packets in file 
    packetSource := gopacket.NewPacketSource(handle, handle.LinkType()) 
    for packet := range packetSource.Packets() { 
     fmt.Println 
     } 
} 

これが返されます。

PACKET: 122 bytes, wire length 122 cap length 122 @ 2017-06-11 02:57:03.133873 +0100 WEST 
- Layer 1 (36 bytes) = RadioTap {Contents=[..36..] Payload=[..86..] Version=0 Length=36 Present=2684370991 TSFT=661956589449 Flags=FCS Rate=1 Mb/s ChannelFrequency=2412 MHz ChannelFlags=CCK,Ghz2 FHSS=0 DBMAntennaSignal=-91 DBMAntennaNoise=0 LockQuality=0 TxAttenuation=0 DBTxAttenuation=0 DBMTxPower=0 Antenna=0 DBAntennaSignal=0 DBAntennaNoise=0 RxFlags= TxFlags= RtsRetries=0 DataRetries=0 MCS= AMPDUStatus=ref#0 VHT=} 
- Layer 2 (24 bytes) = Dot11 {Contents=[..24..] Payload=[..58..] Type=DataQOSData Proto=0 Flags=TO-DS,WEP DurationID=0 Address1=11:22:33:44:55:66 Address2=00:11:22:33:44:55 Address3=11:22:33:44:55:66 Address4= SequenceNumber=0 FragmentNumber=0 Checksum=4262477891} 
- Layer 3 (58 bytes) = Dot11WEP {Contents=[..58..] Payload=[]} 

PACKET: 116 bytes, wire length 116 cap length 116 @ 2017-06-11 02:57:03.243457 +0100 WEST 
- Layer 1 (18 bytes) = RadioTap {Contents=[..18..] Payload=[..102..] Version=0 Length=18 Present=18478 TSFT=0 Flags= Rate=1 Mb/s ChannelFrequency=2417 MHz ChannelFlags=CCK,Ghz2 FHSS=0 DBMAntennaSignal=-25 DBMAntennaNoise=0 LockQuality=0 TxAttenuation=0 DBTxAttenuation=0 DBMTxPower=0 Antenna=1 DBAntennaSignal=0 DBAntennaNoise=0 RxFlags= TxFlags= RtsRetries=0 DataRetries=0 MCS= AMPDUStatus=ref#0 VHT=} 
- Layer 2 (24 bytes) = Dot11 {Contents=[..24..] Payload=[..74..] Type=DataQOSData Proto=0 Flags=TO-DS,WEP DurationID=314 Address1=00:11:22:33:44:55 Address2=11:22:33:44:55:66 Address3=00:11:22:33:44:55 Address4= SequenceNumber=0 FragmentNumber=0 Checksum=412506031} 
- Layer 3 (74 bytes) = Dot11WEP {Contents=[..74..] Payload=[]} 

を私は例えば、パケットのSSIDや各層の内部の詳細情報を見たいのですが、毎回私は私が得る項目をドリルダウンしてみてください：

RadioTap 
Dot11 
Dot11WEP 
RadioTap 
Dot11 
Dot11WEP 

上記の出力用のコード

package main 



import (
    "fmt" 
    "github.com/google/gopacket" 
    "github.com/google/gopacket/pcap" 
    //"github.com/google/gopacket/layers" 
    "log" 
) 

var (
    pcapFile string = "myFile.pcap" 
    handle *pcap.Handle 
    err  error 
) 

func main() { 
    // Open file instead of device 
    handle, err = pcap.OpenOffline(pcapFile) 
    if err != nil { log.Fatal(err) } 
    defer handle.Close() 

    // Loop through packets in file 
    packetSource := gopacket.NewPacketSource(handle, handle.LinkType()) 
    for packet := range packetSource.Packets() { 
     for _, p := range packet.Layers() { 
     for _, b := range p.LayerType() { 
      fmt.Println(b) 
     } 
     } 
    } 
} 

しかし、現実には、私はDOT11層からSSID/BSSIDとpacktet内部のフラグを知っていただきたいと思います。 example file Network_Join_Nokia_Mobile.pcap from Wiresharkと出力の

Answer 1

package main 

import (
    "fmt" 
    "github.com/google/gopacket" 
    "github.com/google/gopacket/pcap" 
    "github.com/google/gopacket/layers" 
    "log" 
) 

var (
    pcapFile string = "Network_Join_Nokia_Mobile.pcap" 
    handle *pcap.Handle 
    err  error 
) 

func main() { 
    // Open file instead of device 
    handle, err = pcap.OpenOffline(pcapFile) 
    if err != nil { log.Fatal(err) } 
    defer handle.Close() 

    // Loop through packets in file 
    packetSource := gopacket.NewPacketSource(handle, handle.LinkType()) 
    for packet := range packetSource.Packets() { 
     fmt.Println(packet.Metadata().CaptureInfo.Timestamp) 
     dot11 := packet.Layer(layers.LayerTypeDot11) 
     if nil != dot11 { 
       dot11, _ := dot11.(*layers.Dot11) 
       // the flags are empty in many of the packets of this example capture file 
       fmt.Printf("BSSID: %v Flags: %+v\n", dot11.Address3, dot11.Flags) 
     } 
     dot11info := packet.Layer(layers.LayerTypeDot11InformationElement) 
     // some wlan frames contain these with the SSID, usually beacons, probes and association requests 
     if nil != dot11info { 
       dot11info, _ := dot11info.(*layers.Dot11InformationElement) 
       if dot11info.ID == layers.Dot11InformationElementIDSSID { 
         fmt.Printf("SSID: %q\n", dot11info.Info) 
       } 
     } 
     fmt.Printf("\n") 
    } 
} 

パート：あなたは、あなたの質問に使用されるキャプチャファイルは、SSIDを含む層とのフレームが含まれていないことを

2000-01-01 00:05:04.913478 +0000 UTC 
BSSID: 00:01:e3:41:bd:6e Flags: Retry 
SSID: "martinet3" 

注意。