pcaplite

🕵️‍♂️ go-pcaplite – Lightweight Network Sniffer in Go

🚀 Overview

go-pcaplite is a lightweight Go library for capturing and inspecting network traffic in real time.
It wraps gopacket and simplifies packet sniffing with an easy-to-use API.

🔥 Features

• 📡 Live packet capture from any interface
• 🔍 Supports BPF filters (tcp, udp, icmp, arp, etc.)
• 📝 Extracts protocol metadata (DNS, ARP, etc.)
• 🖥️ Cross-platform: Linux, macOS, Windows
• ⚡ Designed for simplicity and integration into other tools

🛠️ Installation

go get github.com/alexcfv/go-pcaplite

🔑 Running on Different Operating Systems

🌐 Common Network Interfaces

🔍 Example Filters (BPF Syntax)

📦 Example

package main

import (
    "fmt"
    "log"
    "github.com/alexcfv/go-pcaplite"
)

func main() {
    opts := pcaplite.CaptureOptions{
        Filter:  "tcp port 443 or udp or arp or icmp", // HTTPS + other protocols
        Promisc: true,
    }

    packets, err := pcaplite.Capture("en0", opts) //en0 macOS interface
    if err != nil {
        log.Fatal(err)
    }

    for p := range packets {
        fmt.Printf("[%s] %s:%s -> %s:%s | %s | %d bytes\n",
            p.Timestamp.Format("15:04:05"),
            p.SrcIP, p.SrcPort,
            p.DstIP, p.DstPort,
            p.Protocol, p.Length,
        )

        // Print additional metadata (DNS, ARP, etc.)
        for k, v := range p.Extra {
            fmt.Printf("  %s: %s\n", k, v)
        }
    }
}

📦 Output:

[21:09:29] 192.168.0.30:49380 -> 17.248.213.71:443 | TCP | 66 bytes
[21:09:29] 17.248.213.71:443 -> 192.168.0.30:49380 | TCP | 78 bytes
[21:09:29] 17.248.213.71:443 -> 192.168.0.30:49380 | TCP | 66 bytes
[21:09:29] 17.248.213.71:443 -> 192.168.0.30:49380 | TCP | 66 bytes
[21:09:29] 192.168.0.30:49380 -> 17.248.213.71:443 | TCP | 90 bytes
[21:09:29] 192.168.0.30:49380 -> 17.248.213.71:443 | TCP | 66 bytes
[21:09:29] 17.248.213.71:443 -> 192.168.0.30:49380 | TCP | 78 bytes
[21:09:29] 192.168.0.30:49380 -> 17.248.213.71:443 | TCP | 54 bytes
[21:09:31] 192.168.0.31:5353 -> 224.0.0.251:5353 | UDP | 119 bytes
[21:09:31] fe80::8001:51ff:fe3b:55ce:5353 -> ff02::fb:5353 | UDP | 139 bytes

✍️ From the Author

Hi! I’m the author of go-pcaplite.

I also have a CLI utility for deeper traffic analysis.
You can check it out here: CLI sniffer

📜 License

MIT © 2025 alexcfv