# pcap-web-tools

A small web application with tools for the pcap packet capture format.
Plain Go: the standard library, `html/template` and embedded static files. There is no JavaScript frontend.

## Running

```sh
make run            # or: go run . -addr localhost:8080
```

Then open http://localhost:8080.

## Tools

### Hex → pcap (`/hex2pcap`)

Builds a single-packet pcap file from pasted hex.

- Three fields: **layer 2**, **layer 3** and **payload**. Each one is hex-decoded and the three are concatenated. Any field can be empty, so you can also paste a whole packet into one field.
- The hex input tolerates whitespace, `:`, `-`, `,`, `.`, `0x` and `\x`.
- **Recalculate IP lengths and checksums** (optional) rewrites:
  - IPv4 total length and header checksum, or the IPv6 payload length
  - the UDP length
  - the TCP, UDP, ICMP, ICMPv6 or SCTP (CRC32c) checksum

  It walks IPv6 extension headers and uses the final destination from a routing header in the pseudo-header. Fragments only get their IP header fixed.

  The IP header is taken to start at the layer 3 field. If that field is empty, the tool parses the link-layer header to find it: Ethernet (including VLAN and QinQ), Linux SLL or SLL2.
- **Link type**: *Auto* picks Raw IP when layer 2 is empty and layer 3 is set, and Ethernet otherwise. You can also pick a link type from the list or enter any numeric LINKTYPE.
- **Preview** shows the fixups that were applied and a hex dump coloured by layer, with changed bytes underlined. **Download pcap** returns the file.

## Layout

```
main.go                 entry point, HTTP server
internal/web/           handlers, tool registry, embedded templates and CSS
internal/pcap/          pcap file writer
internal/inet/          IPv4/IPv6 length and checksum fixups, IP header locator
internal/hexutil/       lenient hex decoding
```

To add a tool, add an entry to `tools` in `internal/web/server.go`, a template in `internal/web/templates/`, and register its routes in `web.New`.