search

packetcap / go-pcap

Packet capture library and tools in native go
Apache License 2.0
26 stars 7 forks source link

OpenLive for any interface in MacOS #58

Open tjjh89017 opened 2 months ago

tjjh89017 commented 2 months ago

Is it possible to have a OpenLive handel to listen all interfaces in once? Thank you

Something like tcpdump -i any

deitch commented 2 months ago

It does it already. What happens if you pass "" as the iface?

tjjh89017 commented 2 months ago

I tired sample code with the following command sudo ./pcap (default is "") I got this error.

capturing from interface
FATA[0000] failed to set the BPF interface: error: 6
tjjh89017 commented 2 months ago

By the way, I just tested tcpdump in MacOS M3. I cannot use -i any I'm not sure if there is some way to have the same behavior like Linux for Raw Socket with SO_ATTACH_FILTER on all interfaces

Also I tested cmd/main.go with BPF string udp dst port 5566 and udp[12:4] == 2112A442 It didn't filter any packet, I still get all kinds of packet from en0

deitch commented 2 months ago

Yeah, macOS doesn't have the same constructs (and the same way of working). The interface access call is here. You would need to have an option to set a loop for it. Feel free to open a PR.