pcap-web-tools/README.md

pcap-web-tools

A small web application with tools for the pcap packet capture format. Plain Go: the standard library, html/template and embedded static files. There is no JavaScript frontend.

Running

make run            # or: go run . -addr localhost:8080

Then open http://localhost:8080.

Tools

Hex → pcap (/hex2pcap)

Builds a single-packet pcap file from pasted hex.

• Three fields: layer 2, layer 3 and payload. Each one is hex-decoded and the three are concatenated. Any field can be empty, so you can also paste a whole packet into one field.

• The hex input tolerates whitespace, :, -, ,, ., 0x and \x.

• Recalculate IP lengths and checksums (optional) rewrites:

  • IPv4 total length and header checksum, or the IPv6 payload length
  • the UDP length
  • the TCP, UDP, ICMP, ICMPv6 or SCTP (CRC32c) checksum

  It walks IPv6 extension headers and uses the final destination from a routing header in the pseudo-header. Fragments only get their IP header fixed.

  The IP header is taken to start at the layer 3 field. If that field is empty, the tool parses the link-layer header to find it: Ethernet (including VLAN and QinQ), Linux SLL or SLL2.

• Link type: Auto picks Raw IP when layer 2 is empty and layer 3 is set, and Ethernet otherwise. You can also pick a link type from the list or enter any numeric LINKTYPE.

• Preview shows the fixups that were applied and a hex dump coloured by layer, with changed bytes underlined. Download pcap returns the file.

Layout

main.go                 entry point, HTTP server
internal/web/           handlers, tool registry, embedded templates and CSS
internal/pcap/          pcap file writer
internal/inet/          IPv4/IPv6 length and checksum fixups, IP header locator
internal/hexutil/       lenient hex decoding

To add a tool, add an entry to tools in internal/web/server.go, a template in internal/web/templates/, and register its routes in web.New.