I'm trying to parse pcapng file with gopacket package. It works well, but sometimes i meet custom (modified) packets and i need to detect them.
I know for sure that this custom packets has encapsulation type 148, that can't be recognized by wireshark or gopacket library. Here's the example of the packet:
When i'm try to analyze pcapng file with gopacket, i can check packet AncillaryData from packet.Metadata() for LinkTypeEthernet or other types. But for custom packets packet.Metadata().AncillaryData[0] returns LinkTypeUnknow.
Here's an example of code:
f, err := os.Open("sample.pcapng")
if err != nil {
return err
}
defer f.Close()
r, err := pcapgo.NewNgReader(f, pcapgo.DefaultNgReaderOptions)
if err != nil {
return err
}
packetSource := gopacket.NewPacketSource(r, layers.LayerTypeEthernet)
for packet := range packetSource.Packets() {
if packet.Metadata().AncillaryData[0] == layers.LinkTypeEthernet {
// It works!
}
}
But this code throws an error: undefined layers.LinkTypeUnknown
if packet.Metadata().AncillaryData[0] == layers.LinkTypeUnknown {
// Doesn't work
}
So, how can i check ancillary data for LinkTypeUnknown or value 148? Or, please, tell me another way to recognize this custom packets.