afpacket example with filter

[gmonk]

Is it possible to assign bpf while using afpacket similar to pcap ? and if so could you provide an example

Thanks

[negbie]

type afpacketHandle struct {
    TPacket *afpacket.TPacket
}

func (h *afpacketHandle) ReadPacketData() (data []byte, ci gopacket.CaptureInfo, err error) {
    return h.TPacket.ReadPacketData()
}

func (h *afpacketHandle) ZeroCopyReadPacketData() (data []byte, ci gopacket.CaptureInfo, err error) {
    return h.TPacket.ZeroCopyReadPacketData()
}

func (h *afpacketHandle) SetBPFFilter(filter string, snaplen int) (err error) {
    pcapBPF, err := pcap.CompileBPFFilter(layers.LinkTypeEthernet, snaplen, filter)
    if err != nil {
        return err
    }
    bpfIns := []bpf.RawInstruction{}
    for _, ins := range pcapBPF {
        bpfIns2 := bpf.RawInstruction{
            Op: ins.Code,
            Jt: ins.Jt,
            Jf: ins.Jf,
            K:  ins.K,
        }
        bpfIns = append(bpfIns, bpfIns2)
    }
    if h.TPacket.SetBPF(bpfIns); err != nil {
        return err
    }
    return h.TPacket.SetBPF(bpfIns)
}

[gmonk]

Awsome.. Thank you for this

[gconnell]

Thanks, negbie! Would either you or gmonk like to add a quick code sample to the examples/ directory?

[negbie]

Sure, I will do it in the following days.

[negbie]

If this https://github.com/google/gopacket/pull/460/commits/511567d6ae8083f45de05b8c00a4a300b51efa3b is too much and you only want a additional function which takes a BPF filter string and returns []bpf.RawInstruction{} so it could be used with TPacket.SetBPF(), tell me.

[notti]

Example code in #460 was merged, so closing this