Go-pcap

Go-pcap is a native Go packet-capture library and tcpdump-style cBPF filter compiler. It provides a libpcap-like capture interface without CGO, making CGO_ENABLED=0 builds and cross-compilation straightforward.

Key features

• Native Go implementation: Requires neither libpcap nor CGO, enabling static builds and straightforward cross-compilation.
• Live packet capture: Provides a libpcap-like live-capture interface for Linux and macOS/Darwin.
• cBPF filter compiler: Compiles commonly used tcpdump-style expressions into classic BPF instructions.
• Link-type awareness: Compiles the same filter syntax for Ethernet (EN10MB) or raw IP (L3) packet layouts.
• Command-line utility: Includes a pcap CLI for live capture with tcpdump-compatible packet summaries.

Use cases

• Network observability tools: Provides native Go packet capture for traffic collectors, protocol analyzers, and troubleshooting utilities.
• CGO-free environments: Fits static binaries, minimal containers, and projects that require straightforward cross-compilation.
• Traffic filtering: Generates cBPF instructions from tcpdump-style expressions for common IPv4, IPv6, ARP, TCP, UDP, and ICMP traffic.
• Command-line diagnostics: Uses the bundled pcap CLI to capture live traffic and print packet summaries.

Get involved

See the Go-pcap documentation for usage, filter syntax, and development guidance. Contributions through Issues and Pull Requests are welcome, especially for protocol support, link types, compatibility cases, and performance improvements. The project is licensed under Apache License 2.0.