{"id":13775163,"url":"https://github.com/dreadl0ck/gopcap","last_synced_at":"2025-09-23T17:09:20.879Z","repository":{"id":81482579,"uuid":"156360498","full_name":"dreadl0ck/gopcap","owner":"dreadl0ck","description":"Fast Golang PCAP Reader \u0026 Benchmark Comparison","archived":false,"fork":false,"pushed_at":"2025-07-02T16:00:44.000Z","size":28,"stargazers_count":76,"open_issues_count":0,"forks_count":10,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-07-02T16:46:43.367Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dreadl0ck.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":"AUTHORS"}},"created_at":"2018-11-06T09:41:34.000Z","updated_at":"2025-07-02T15:58:24.000Z","dependencies_parsed_at":"2023-06-18T07:15:12.231Z","dependency_job_id":null,"html_url":"https://github.com/dreadl0ck/gopcap","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/dreadl0ck/gopcap","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dreadl0ck%2Fgopcap","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dreadl0ck%2Fgopcap/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dreadl0ck%2Fgopcap/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dreadl0ck%2Fgopcap/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dreadl0ck","download_url":"https://codeload.github.com/dreadl0ck/gopcap/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dreadl0ck%2Fgopcap/sbom","scorecard":{"id":355478,"data":{"date":"2025-08-11","repo":{"name":"github.com/dreadl0ck/gopcap","commit":"b451ed889ee13da4bbd253b281efa074c0d2a6e5"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":3.4,"checks":[{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Code-Review","score":2,"reason":"Found 3/15 approved changesets -- score normalized to 2","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Maintained","score":1,"reason":"1 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Pinned-Dependencies","score":-1,"reason":"no dependencies found","details":null,"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: GNU General Public License v3.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 6 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-18T09:28:11.341Z","repository_id":81482579,"created_at":"2025-08-18T09:28:11.341Z","updated_at":"2025-08-18T09:28:11.341Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":276613309,"owners_count":25673400,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-23T02:00:09.130Z","response_time":73,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T17:01:34.705Z","updated_at":"2025-09-23T17:09:20.860Z","avatar_url":"https://github.com/dreadl0ck.png","language":"Go","funding_links":[],"categories":["\u003ca id=\"f13469c9891173804423be4403b2c4ff\"\u003e\u003c/a\u003epcap"],"sub_categories":["\u003ca id=\"eb49514924c3f4bf2acf6f3a4436af13\"\u003e\u003c/a\u003e未分类"],"readme":"# GOPCAP\n\n[![Go Report Card](https://goreportcard.com/badge/github.com/dreadl0ck/gopcap)](https://goreportcard.com/report/github.com/dreadl0ck/gopcap)\n[![License](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://raw.githubusercontent.com/dreadl0ck/gopcap/master/docs/LICENSE)\n[![Golang](https://img.shields.io/badge/Go-1.10-blue.svg)](https://golang.org)\n![Linux](https://img.shields.io/badge/Supports-Linux-green.svg)\n![macOS](https://img.shields.io/badge/Supports-macOS-green.svg)\n![Windows](https://img.shields.io/badge/Supports-Windows-green.svg)\n[![GoDoc](https://img.shields.io/badge/godoc-reference-blue.svg)](https://godoc.org/github.com/dreadl0ck/gopcap)\n\nThis package provides support for reading Packet Capture (PCAP) files efficiently in pure Go\nand provides benchmarks against other packages offering the same functionality.\n\n**Update**: I just discovered the go implementation from gopacket https://github.com/google/gopacket/tree/master/pcapgo,\nwhich is comparatively fast and has support for both reading and writing PCAP + PCAP-NG and live capture in pure Go (awesome!).\nI've added the gopacket/pcapgo implementation to the benchmarks as well.\nI recommend to use the pcapgo library instead of this one, it offers far more functionality.\n\nHowever, in my benchmarks **this implementation still is slightly faster**.\nSo, if performance is crucial and you only need to read PCAP, this lib might still be interesting.\n\n**The problem:**\n\nExisting implementations often use **binary.Read** for parsing the binary data into the expected structure.\nHowever, the function makes use of reflection, which hurts performance.\n\nThis implementation does not use **binary.Read** to parse the file and packet headers,\nand therefore is much faster.\n\nThe following API is exported by the package:\n\n```golang\n// Count all packet inside the PCAP file at path\nfunc Count(path string) int64\n```\n```golang\n// Reader for PCAP\ntype Reader\n```\n```golang\n// Open file at path and return reader and error\nfunc Open(filename string) (*Reader, error)\n```\n```golang\n// Close reader\nfunc (r *Reader) Close() error\n```\n```golang\n// ReadNextPacket reads the next packet and returns header,data,error\nfunc (r *Reader) ReadNextPacket() (PacketHeader, []byte, error)\n```\n```golang\n// ReadNextPacketHeader reads the next packet header and returns header,data,error\nfunc (r *Reader) ReadNextPacketHeader() (PacketHeader, []byte, error)\n```\n\nData structures for the PCAP file header and packet headers are provided:\n\n```golang\ntype FileHeader struct {\n    // magic number\n    MagicNumber uint32\n    // major version number\n    VersionMajor uint16\n    // minor version number\n    VersionMinor uint16\n    // GMT to local correction\n    Thiszone int32\n    // accuracy of timestamps\n    Sigfigs uint32\n    // max length of captured packets, in octets\n    Snaplen uint32\n    // data link type\n    Network uint32\n}\n\ntype PacketHeader struct {\n    // timestamp seconds\n    TsSec int32\n    // timestamp microseconds\n    TsUsec int32\n    // number of octets of packet saved in file\n    CaptureLen int32\n    // actual length of packet\n    OriginalLen int32\n}\n```\n\n## Usage\n\nReading a PCAP file from disk can be done by calling **gopcap.Open(path)** and looping on **r.ReadNextPacket()** of the returned reader.\nAdditionally there is a function called **gopcap.Count(path)** that returns the total count of packets in the file (useful for displaying progress).\n\n```golang\n// get total packet count\nfmt.Println(\"total:\", gopcap.Count(path))\n\n// create reader\nr, err := gopcap.Open(path)\nif err != nil {\n    panic(err)\n}\ndefer r.Close()\n\n// loop over packets\nfor {\n    h, data, err := r.ReadNextPacket()\n    if err != nil {\n        if err == io.EOF {\n            println(\"EOF\")\n            break\n        }\n        panic(err)\n    }\n    fmt.Println(h, len(data))\n}\n```\n\n## Benchmarks\n\nThere are a few pure go implementations for parsing PCAP files available.\nThe following have not been evaluated in the benchmark, for the given reason(s):\n\n- https://github.com/davecheney/pcap, Latest commit 10760a1  on Aug 19, 2012, fails to compile with various errors\n- https://github.com/Lukasa/gopcap, limited in functionality, API only allows to parse a file completely, which is unpractical for big files.\n\nThese implementation are included in the benchmarks, in the order they are listed:\n\n- https://github.com/dreadl0ck/gopcap (this package)\n- https://github.com/github.com/0intro/pcap\n- https://github.com/google/gopacket/pcap\n- https://godoc.org/go.universe.tf/netboot\n- https://github.com/github.com/miekg/pcap\n- https://github.com/google/gopacket/tree/master/pcapgo\n\nThe benchmark code fetches a single packet in a loop, and discards all data that is not needed.\nMake sure the PCAP file for the test is big enough, otherwise the tests wont produce meaningful results.\n\nI didn't include the dump in the repo because it is around 1.0G in size.\nThe used PCAP file (**maccdc2012_00000.pcap**) is from the National CyberWatch Mid-Atlantic Collegiate Cyber Defense Competition (MACCDC),\nwhich can be downloaded here: https://www.netresec.com/?page=MACCDC\n\nHere are the results of a few runs on my development machine (MacBook Pro 2018, 32GB RAM, 2,9 GHz Intel Core i9):\n\n    $ go test -bench=.\n    goos: darwin\n    goarch: amd64\n    pkg: github.com/dreadl0ck/gopcap\n    BenchmarkReadPcap-12                  \t10000000\t       142 ns/op\t     111 B/op\t       1 allocs/op\n    BenchmarkReadPcap0Intro-12            \t  300000\t      4714 ns/op\t     203 B/op\t       8 allocs/op\n    BenchmarkReadPcapGoPacket-12          \t 5000000\t       258 ns/op\t       0 B/op\t       0 allocs/op\n    BenchmarkReadPcapNetboot-12           \t 3000000\t       510 ns/op\t     235 B/op\t       8 allocs/op\n    BenchmarkReadPcapMiekg-12             \t 3000000\t       582 ns/op\t     283 B/op\t       6 allocs/op\n    BenchmarkReadPcapGopacketPcapGo-12    \t10000000\t       149 ns/op\t      98 B/op\t       0 allocs/op\n    PASS\n    ok  \tgithub.com/dreadl0ck/gopcap\t10.555s\n    \n    $ go test -bench=.\n    goos: darwin\n    goarch: amd64\n    pkg: github.com/dreadl0ck/gopcap\n    BenchmarkReadPcap-12                  \t10000000\t       193 ns/op\t     111 B/op\t       1 allocs/op\n    BenchmarkReadPcap0Intro-12            \t  200000\t      6181 ns/op\t     224 B/op\t       8 allocs/op\n    BenchmarkReadPcapGoPacket-12          \t 5000000\t       356 ns/op\t       0 B/op\t       0 allocs/op\n    BenchmarkReadPcapNetboot-12           \t 2000000\t       653 ns/op\t     223 B/op\t       8 allocs/op\n    BenchmarkReadPcapMiekg-12             \t 2000000\t       737 ns/op\t     271 B/op\t       6 allocs/op\n    BenchmarkReadPcapGopacketPcapGo-12    \t10000000\t       200 ns/op\t      98 B/op\t       0 allocs/op\n    PASS\n    ok  \tgithub.com/dreadl0ck/gopcap\t11.911s\n    \n    $ go test -bench=.\n    goos: darwin\n    goarch: amd64\n    pkg: github.com/dreadl0ck/gopcap\n    BenchmarkReadPcap-12                  \t10000000\t       145 ns/op\t     111 B/op\t       1 allocs/op\n    BenchmarkReadPcap0Intro-12            \t  300000\t      4800 ns/op\t     203 B/op\t       8 allocs/op\n    BenchmarkReadPcapGoPacket-12          \t 5000000\t       262 ns/op\t       0 B/op\t       0 allocs/op\n    BenchmarkReadPcapNetboot-12           \t 3000000\t       664 ns/op\t     235 B/op\t       8 allocs/op\n    BenchmarkReadPcapMiekg-12             \t 2000000\t       732 ns/op\t     271 B/op\t       6 allocs/op\n    BenchmarkReadPcapGopacketPcapGo-12    \t10000000\t       197 ns/op\t      98 B/op\t       0 allocs/op\n    PASS\n    ok  \tgithub.com/dreadl0ck/gopcap\t11.557s\n\n    $ go test -bench=.\n    goos: darwin\n    goarch: amd64\n    pkg: github.com/dreadl0ck/gopcap\n    BenchmarkReadPcap-12                  \t10000000\t       172 ns/op\t     125 B/op\t       2 allocs/op\n    BenchmarkReadPcap0Intro-12            \t  300000\t      4175 ns/op\t     203 B/op\t       8 allocs/op\n    BenchmarkReadPcapGoPacket-12          \t 5000000\t       275 ns/op\t       0 B/op\t       0 allocs/op\n    BenchmarkReadPcapNetboot-12           \t 3000000\t       659 ns/op\t     235 B/op\t       8 allocs/op\n    BenchmarkReadPcapMiekg-12             \t 2000000\t       560 ns/op\t     271 B/op\t       6 allocs/op\n    BenchmarkReadPcapGopacketPcapGo-12    \t10000000\t       194 ns/op\t      98 B/op\t       0 allocs/op\n    PASS\n    ok  \tgithub.com/dreadl0ck/gopcap\t11.370s\n\n    $ go test -bench=.\n    goos: darwin\n    goarch: amd64\n    pkg: github.com/dreadl0ck/gopcap\n    BenchmarkReadPcap-12                  \t10000000\t       196 ns/op\t     111 B/op\t       1 allocs/op\n    BenchmarkReadPcap0Intro-12            \t  300000\t      4821 ns/op\t     203 B/op\t       8 allocs/op\n    BenchmarkReadPcapGoPacket-12          \t 3000000\t       436 ns/op\t       0 B/op\t       0 allocs/op\n    BenchmarkReadPcapNetboot-12           \t 2000000\t       766 ns/op\t     223 B/op\t       8 allocs/op\n    BenchmarkReadPcapMiekg-12             \t 2000000\t       855 ns/op\t     271 B/op\t       6 allocs/op\n    BenchmarkReadPcapGopacketPcapGo-12    \t 5000000\t       278 ns/op\t     104 B/op\t       1 allocs/op\n    PASS\n    ok  \tgithub.com/dreadl0ck/gopcap\t11.904s\n\nResults vary, but this implementation appears to be **slightly faster** than gopacket/pcapgo.\n**Can anyone explain why the amount of allocations varies in between different runs?\nHow can 0 allocs/op happen?**\n\nThe gopacket pcap library and fork from miekg both use C bindings.\nFor the benchmark of the gopacket pcap implementation, the **ZeroCopyReadPacketData()** function was used.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdreadl0ck%2Fgopcap","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdreadl0ck%2Fgopcap","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdreadl0ck%2Fgopcap/lists"}