Skip to content

Conversation

@j4m3s-s
Copy link

@j4m3s-s j4m3s-s commented Sep 3, 2025

Hey~

This PR (not ready for prod yet, I'd like to discuss some implementation details) adds support for PCAP receiver. I.e, reading a pcap file to replay it through goflow. (Issue #415 )

I have a few questions :

  • by default reading a pcap uses libpcap (through google/gopacket) which is probably not something to ship by default.
    I've implemented a "stub" receiver that returns an error by default (with a build tag to build the pcap version). Wdyt ?
    If you agree with that approach, I can add documentation and build within the CI ~
  • The daemon doesn't exit once it's finished reading (which I don't really find to be an issue, I just thought it would be worth mentioning)
  • I'm quite conflicted into how I could add the choice of PCAP through the CLI.
    There are currently two adjacent things :
    • listening on a port (UDP) || a file for PCAP
    • choosing the "interpreter" of the data (i.e netflow, flow, etc)
      But currently there's only the listener argument which conflates the two in one.
      Do you have an idea / recommendation into which way you'd prefer me to implement ?

Thanks by advance,

@lspgn
Copy link
Member

lspgn commented Sep 4, 2025

Thank you for your contribution.
Unfortunately, I do not have the time to maintain extra implementation nor test them.
It also introduces breaking changes with new function signature.
I initially assumed it would capture live interfaces instead of a file. GoFlow2 is not meant to be a batch tool. In this case I would suggest importing the "producer" library to convert the captured packets into protobuf or json.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants