golang拥有wireshark数据包解析能力

wireshark拥有世界上最全面的协议解析能力并且还在不断更新中，通过调研，没有办法找到与wireshark同水平的解析工具。

为了使得golang语言可以拥有wireshark一样强大的协议解析能力，库 gowireshark通过golang --wrap–> c --wrap–> wireshark dll的形式做到了这点。

1. 功能和实现

简单来看下这个库的功能，并分析它的实现：

• 可以读取离线pcap文件或者抓取指定网卡数据包并解析

  其中c封装的接口在include/目录的lib.h、offline.h、online.h中，print_xxx开头的接口调用的是原生的wireshark接口proto_tree_print打印协议树，print_hex_data打印十六进制；
  get_proto_tree_json接口封装的get_proto_tree_json函数明显是改变自原生wireshark接口write_json_proto_tree(print.c文件中)，原本write_json_proto_tree生成和输出json结果使用的是jdump对象，修改后使用cJson替代。

• 支持像wireshark一样解析各种协议，并输出为json格式，字段也能翻译成wireshark一样的解释性文字：

json结果：

{"_index": "packets-2020-12-14","_type": "doc","_score": {},"offset": ["0000", "0010", "0020", "0030", "0040", "0050", "0060"],"hex": ["00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 02", "00 58 00 01 40 00 40 84 3c 1d 7f 00 00 01 7f 00", "00 01 98 3a 96 48 a6 25 c3 63 00 00 00 00 00 03", "00 38 e3 0b 04 a7 00 00 00 00 00 00 00 3e 40 01", "00 0e 00 00 02 00 4e 00 02 00 14 00 00 00 01 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 55", "79 4b 65 55 00 00                              "],"ascii": ["..............E.", ".X..@.@.<.......", "...:.H.%.c......", ".8...........>@.", "......N.........", "...............U", "yKeU.."],"_source": {"layers": {"frame": {"frame.section_number": "1","frame.interface_id": "0","frame.encap_type": "Ethernet (1)","frame.time": "Dec 14, 2020 16:01:11.974420814 UTC","frame.offset_shift": "0.000000000 seconds","frame.time_epoch": "1607961671.974420814 seconds","frame.time_delta": "0.000021538 seconds","frame.time_delta_displayed": "0.000021538 seconds","frame.time_relative": "0.000000000 seconds","frame.number": "5","frame.len": "102","frame.cap_len": "102","frame.marked": "False","frame.ignored": "False","frame.protocols": "eth:ethertype:ip:sctp:f1ap"},"eth": {"eth.dst": "00:00:00:00:00:00 (00:00:00:00:00:00)","eth.dst_tree": {"eth.dst_resolved": "00:00:00:00:00:00","eth.dst.oui": "00:00:00","eth.addr": "00:00:00:00:00:00 (00:00:00:00:00:00)","eth.addr_resolved": "00:00:00:00:00:00","eth.addr.oui": "00:00:00","eth.dst.lg": "Globally unique address (factory default)","eth.lg": "Globally unique address (factory default)","eth.dst.ig": "Individual address (unicast)","eth.ig": "Individual address (unicast)"},"eth.src": "00:00:00:00:00:00 (00:00:00:00:00:00)","eth.src_tree": {"eth.src_resolved": "00:00:00:00:00:00","eth.src.oui": "00:00:00","eth.addr": "00:00:00:00:00:00 (00:00:00:00:00:00)","eth.addr_resolved": "00:00:00:00:00:00","eth.addr.oui": "00:00:00","eth.src.lg": "Globally unique address (factory default)","eth.lg": "Globally unique address (factory default)","eth.src.ig": "Individual address (unicast)","eth.ig": "Individual address (unicast)"},"eth.type": "IPv4 (0x0800)"},"ip": {"ip.version": "4","ip.hdr_len": "20","ip.dsfield": "0x02","ip.dsfield_tree": {"ip.dsfield.dscp": "Default (0)","ip.dsfield.ecn": "ECN-Capable Transport codepoint '10' (2)"},"ip.len": "88","ip.id": "0x0001 (1)","ip.flags": "0x02","ip.flags_tree": {"ip.flags.rb": "Not set","ip.flags.df": "Set","ip.flags.mf": "Not set"},"ip.frag_offset": "0","ip.ttl": "64","ip.proto": "SCTP (132)","ip.checksum": "0x3c1d","ip.checksum.status": "Unverified","ip.src": "127.0.0.1","ip.addr": "127.0.0.1","ip.src_host": "127.0.0.1","ip.host": "127.0.0.1","ip.dst": "127.0.0.1","ip.dst_host": "127.0.0.1"},"sctp": {"sctp.srcport": "38970","sctp.dstport": "38472","sctp.verification_tag": "0xa625c363","sctp.assoc_index": "65535","sctp.port": "38970","sctp.checksum": "0x00000000","sctp.checksum.status": "Unverified","DATA chunk (ordered, complete segment, TSN: 0, SID: 0, SSN: 0, PPID: 62, payload length: 40 bytes)": {"sctp.chunk_type": "DATA (0)","sctp.chunk_type_tree": {"sctp.chunk_bit_1": "Stop processing of the packet","sctp.chunk_bit_2": "Do not report"},"sctp.chunk_flags": "0x03","sctp.chunk_flags_tree": {"sctp.data_i_bit": "Possibly delay SACK","sctp.data_u_bit": "Ordered delivery","sctp.data_b_bit": "First segment","sctp.data_e_bit": "Last segment"},"sctp.chunk_length": "56","sctp.data_tsn": "0","sctp.data_tsn_raw": "3809150119","sctp.data_sid": "0x0000","sctp.data_ssn": "0","sctp.data_payload_proto_id": "F1 AP (62)"}},"f1ap": {"per.choice_index": "1","f1ap.F1AP_PDU": "successfulOutcome (1)","f1ap.F1AP_PDU_tree": {"f1ap.successfulOutcome_element": {"f1ap.procedureCode": "id-F1Setup (1)","per.enum_index": "0","f1ap.criticality": "reject (0)","per.open_type_length": "14","f1ap.value_element": {"f1ap.F1SetupResponse_element": {"per.extension_bit": "0","per.sequence_of_length": "2","f1ap.protocolIEs": "2","f1ap.protocolIEs_tree": {"Item 0: id-TransactionID": {"f1ap.ProtocolIE_Field_element": {"f1ap.id": "id-TransactionID (78)","per.enum_index": "0","f1ap.criticality": "reject (0)","per.open_type_length": "2","f1ap.value_element": {"per.extension_present_bit": "0","f1ap.TransactionID": "20"}}},"Item 1: id-Cause": {"f1ap.ProtocolIE_Field_element": {"f1ap.id": "id-Cause (0)","per.enum_index": "0","f1ap.criticality": "reject (0)","per.open_type_length": "1","f1ap.value_element": {"per.choice_index": "0","f1ap.Cause": "radioNetwork (0)","f1ap.Cause_tree": {"per.extension_present_bit": "0","per.enum_index": "0","f1ap.radioNetwork": "unspecified (0)"}}}}}}}}}}}}
}

• 目前好像还有内存泄露问题和支持多设备实时读取解析功能，wireshark应该无法在线程或协程层面实现并发读取解析，如果使用这个库，也许可以通过docker启动多个微服务来做到。