gopacket清理pcap的地址信息

清理原因

深度学习模型由于需要清理pcap的ip地址、mac地址和端口号进行训练，防止过拟合，如果在识别的过程中，测试数据不进行同样的清理，会影响模型的识别效果，使得相比训练时效果差很多。

一、利用gopacker进行抓包

package main
import (
	"fmt"
	"github.com/google/gopacket"
	"github.com/google/gopacket/layers"
	"github.com/google/gopacket/pcap"
	"log"

	"time"
)
var (
	device      string = "\\Device\\NPF_{B6EC5305-3B8D-4EEC-AE49-3A871F097FD4}"
	snapshotLen int32  = 1024
	promiscuous bool   = false
	err         error
	timeout     time.Duration = 30 * time.Second
	handle      *pcap.Handle
)
func main() {
	// Open device
	handle, err = pcap.OpenLive(device, snapshotLen, promiscuous, timeout)
	if err != nil {log.Fatal(err) }
	defer handle.Close()
	packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
	for packet := range packetSource.Packets() {
		fmt.Println("oldpacket:",packet.Data())
		fmt.Println(packet.Metadata().CaptureInfo)
		printPacketInfo(packet)
		fmt.Println("newpacket:",packet.Data())
		fmt.Println(packet.Metadata().CaptureInfo)

	}
}

二、对pcap每层进行清理

func printPacketInfo(packet gopacket.Packet) {
	// Let's see if the packet is an ethernet packet
	// 判断数据包是否为以太网数据包，可解析出源mac地址、目的mac地址、以太网类型（如ip类型）等
	ethernetLayer := packet.Layer(layers.LayerTypeEthernet)
	if ethernetLayer != nil {
		fmt.Println("Ethernet layer detected.")
		ethernetPacket, _ := ethernetLayer.(*layers.Ethernet)
		fmt.Println("Source MAC: ", ethernetPacket.SrcMAC)
		fmt.Println("Destination MAC: ", ethernetPacket.DstMAC)
		ethernetPacket.SrcMAC[0] = 0
		ethernetPacket.SrcMAC[1] = 0
		ethernetPacket.SrcMAC[2] = 0
		ethernetPacket.SrcMAC[3] = 0
		ethernetPacket.SrcMAC[4] = 0
		ethernetPacket.SrcMAC[5] = 0
		ethernetPacket.DstMAC[0] = 0
		ethernetPacket.DstMAC[1] = 0
		ethernetPacket.DstMAC[2] = 0
		ethernetPacket.DstMAC[3] = 0
		ethernetPacket.DstMAC[4] = 0
		ethernetPacket.DstMAC[5] = 0
		fmt.Println("Source MAC: ", ethernetPacket.SrcMAC)
		fmt.Println("Destination MAC: ", ethernetPacket.DstMAC)
		// Ethernet type is typically IPv4 but could be ARP or other
		fmt.Println("Ethernet type: ", ethernetPacket.EthernetType)
		fmt.Println()
	}
	// Let's see if the packet is IP (even though the ether type told us)
	// 判断数据包是否为IP数据包，可解析出源ip、目的ip、协议号等
	ipLayer := packet.Layer(layers.LayerTypeIPv4)
	if ipLayer != nil {
		fmt.Println("IPv4 layer detected.")
		ip, _ := ipLayer.(*layers.IPv4)
		// IP layer variables:
		// Version (Either 4 or 6)
		// IHL (IP Header Length in 32-bit words)
		// TOS, Length, Id, Flags, FragOffset, TTL, Protocol (TCP?),
		// Checksum, SrcIP, DstIP
		fmt.Printf("From %s to %s\n", ip.SrcIP, ip.DstIP)
		ip.SrcIP[0] = 0
		ip.SrcIP[1] = 0
		ip.SrcIP[2] = 0
		ip.SrcIP[3] = 0
		ip.DstIP[0] = 0
		ip.DstIP[1] = 0
		ip.DstIP[2] = 0
		ip.DstIP[3] = 0
		fmt.Printf("From %s to %s\n", ip.SrcIP, ip.DstIP)
		fmt.Println("Protocol: ", ip.Protocol)
		fmt.Println()
	}
	// Let's see if the packet is TCP
	// 判断数据包是否为TCP数据包，可解析源端口、目的端口、seq序列号、tcp标志位等
	tcpLayer := packet.Layer(layers.LayerTypeTCP)
	if tcpLayer != nil {
		fmt.Println("TCP layer detected.")
		tcp, _ := tcpLayer.(*layers.TCP)
		// TCP layer variables:
		// SrcPort, DstPort, Seq, Ack, DataOffset, Window, Checksum, Urgent
		// Bool flags: FIN, SYN, RST, PSH, ACK, URG, ECE, CWR, NS
		fmt.Printf("From port %d to %d\n", tcp.SrcPort, tcp.DstPort)
		tcp.SrcPort = 0
		tcp.DstPort = 0
		fmt.Printf("From port %d to %d\n", tcp.SrcPort, tcp.DstPort)
		fmt.Println("Sequence number: ", tcp.Seq)
		fmt.Println()
	}
	// Iterate over all layers, printing out each layer type
	fmt.Println("All packet layers:")
	for _, layer := range packet.Layers() {
		fmt.Println("- ", layer.LayerType())
	}
	///.......................................................
	// Check for errors
	// 判断layer是否存在错误
	if err := packet.ErrorLayer(); err != nil {
		fmt.Println("Error decoding some part of the packet:", err)
	}
}