From 3f659a16ce01da4d9578dd5af5b084b7241c0a3f Mon Sep 17 00:00:00 2001 From: Leonid Bugaev Date: Mon, 17 Jan 2022 20:55:43 +0300 Subject: [PATCH] Import reading of pcap files Automatically detect if it is a file (by extension), and do not require specify --input-raw-engine option. Can also run without port, but in this case, it will assume that port value set to `0` and it will show all records from the file. --- input_raw.go | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/input_raw.go b/input_raw.go index 1c7fc04..4bae313 100644 --- a/input_raw.go +++ b/input_raw.go @@ -51,7 +51,18 @@ func NewRAWInput(address string, config RAWInputConfig) (i *RAWInput) { host, _ports, err := net.SplitHostPort(address) if err != nil { - log.Fatalf("input-raw: error while parsing address: %s", err) + // If we are reading pcap file, no port needed + if strings.HasSuffix(address, "pcap") { + host = address + _ports = "0" + err = nil + } else { + log.Fatalf("input-raw: error while parsing address: %s", err) + } + } + + if strings.HasSuffix(host, "pcap") { + i.RAWInputConfig.Engine = capture.EnginePcapFile } var ports []uint16