50 lines
2.7 KiB
Markdown
50 lines
2.7 KiB
Markdown
# pcap-web-tools
|
|
|
|
A small web application with tools for the pcap packet capture format.
|
|
Plain Go: the standard library, `html/template` and embedded static files. There is no JavaScript frontend.
|
|
|
|
## Running
|
|
|
|
```sh
|
|
make run # or: go run . -addr localhost:8080
|
|
```
|
|
|
|
Then open http://localhost:8080.
|
|
|
|
## Tools
|
|
|
|
### Hex → pcap (`/hex2pcap`)
|
|
|
|
Builds a single-packet pcap file from pasted hex.
|
|
|
|
- Three fields: **layer 2**, **layer 3** and **payload**. Each one is hex-decoded and the three are concatenated. Any field can be empty, so you can also paste a whole packet into one field.
|
|
- The hex input tolerates whitespace, `:`, `-`, `,`, `.`, `0x` and `\x`.
|
|
- **Recalculate IP lengths and checksums** (optional) rewrites:
|
|
- IPv4 total length and header checksum, or the IPv6 payload length
|
|
- the UDP length
|
|
- the TCP, UDP, ICMP, ICMPv6 or SCTP (CRC32c) checksum
|
|
|
|
It walks IPv6 extension headers and uses the final destination from a routing header in the pseudo-header. Fragments only get their IP header fixed.
|
|
|
|
The end of the layer 3 field marks where the headers end. The fix uses that boundary for two more fields:
|
|
- **TCP data offset**: set to the length of the TCP header, including options, in the layer 3 field.
|
|
- **SCTP chunk length**: set for the last chunk whose header starts in the layer 3 field. It covers the rest of the packet, so paste chunk data without padding. If the payload already includes padding, the tool keeps a chunk length that matches. Chunks bundled before it keep their own lengths.
|
|
|
|
The IPv4 IHL and the IPv6 extension header lengths are taken as entered, because they are what says where the IP options end. If an IPv4 option doesn't fit inside the IHL, you get a warning. When the layer 3 field is empty, these two fields are left unchanged.
|
|
|
|
The IP header is taken to start at the layer 3 field. If that field is empty, the tool parses the link-layer header to find it: Ethernet (including VLAN and QinQ), Linux SLL or SLL2.
|
|
- **Link type**: *Auto* picks Raw IP when layer 2 is empty and layer 3 is set, and Ethernet otherwise. You can also pick a link type from the list or enter any numeric LINKTYPE.
|
|
- **Preview** shows the fixups that were applied and a hex dump coloured by layer, with changed bytes underlined. **Download pcap** returns the file.
|
|
|
|
## Layout
|
|
|
|
```
|
|
main.go entry point, HTTP server
|
|
internal/web/ handlers, tool registry, embedded templates and CSS
|
|
internal/pcap/ pcap file writer
|
|
internal/inet/ IPv4/IPv6 length and checksum fixups, IP header locator
|
|
internal/hexutil/ lenient hex decoding
|
|
```
|
|
|
|
To add a tool, add an entry to `tools` in `internal/web/server.go`, a template in `internal/web/templates/`, and register its routes in `web.New`.
|