A pure Go library for crafting, dissecting, sending, receiving, and sniffing network packets. goscapy provides an idiomatic Go API with type-safe builders and one-liner shortcut functions.

• Builder API — fluent method chaining for type-safe, explicit packet construction
• Shortcut Functions — one-liners for common protocol stacks with sensible defaults
• Packet Dissect — parse raw bytes into structured packets with auto protocol detection
• Send & Receive — send and receive packets via raw sockets (L2 and L3)
• Packet Sniffing — capture live traffic with callback or channel-based APIs, plus BPF filter support
• Offline Sniffing — replay pcap/pcapng files through the same handler/filter pipeline
• Fragmentation — Fragment/Fragment6 split large packets into IPv4/IPv6 fragments
• Answering Machine — sniff→match→reply framework for service emulation and honeypots
• Debug & Introspection — Hexdump, Show2 (rebuild-and-display), Ls/FieldNames, JSON export, tcpdump/Wireshark bridge
• Auto Checksums — IP, TCP, UDP, ICMP, IGMP, and SCTP (CRC32c) checksums computed automatically
• Layer Binding — automatic field inference between adjacent layers (e.g., IP over Ethernet → EtherType=0x0800)
• Cross-Platform — Darwin (macOS) and Linux with platform-specific raw socket implementations

Most application-layer protocols load on demand via the contrib registry. See pkg/layers and pkg/contrib for the full list.

go get github.com/smallnest/goscapy

// Ethernet + IP + ICMP Echo Request
pkt, err := goscapy.NewEthernet().
    SrcMAC("aa:bb:cc:dd:ee:ff").
    DstMAC("ff:ff:ff:ff:ff:ff").
    Over(goscapy.NewIP().SrcIP("192.168.1.1").DstIP("8.8.8.8")).
    Over(goscapy.NewICMP().Type(8).Code(0)).
    Build()

// Same as above, in one line
pkt, err := goscapy.EtherIPICMP("ff:ff:ff:ff:ff:ff", "8.8.8.8", 8, 0)

raw := []byte{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, ...} // raw bytes
pkt, err := packet.Dissect(raw, packet.DissectEthernet)
fmt.Println(pkt.String()) // "Ethernet / IP / ICMP"

pkt, _ := goscapy.EtherIPICMP("ff:ff:ff:ff:ff:ff", "8.8.8.8", 8, 0)
sendrecv.Send(pkt, "eth0")  // send at L3 (IP level)
sendrecv.Sendp(pkt, "eth0") // send at L2 (Ethernet)

// Callback-based
sniff.Sniff(sniff.SniffConfig{
    Iface:   "eth0",
    Filter:  "icmp",
    Timeout: 10 * time.Second,
}, func(pkt *packet.Packet) bool {
    fmt.Println(pkt)
    return true // continue sniffing
})

// Channel-based
ch, stop := sniff.SniffChan(sniff.SniffConfig{Iface: "eth0", Count: 5})
defer stop()
for pkt := range ch {
    fmt.Println(pkt)
}

Full documentation is available at pkg.go.dev/github.com/smallnest/goscapy.

• Go 1.26+
• macOS or Linux
• Root/administrator privileges for raw socket operations
• tcpdump (optional, for BPF filter string compilation via sniff.CompileFilter)

make build         # Build all packages
make test          # Run all tests
make test-race     # Run tests with race detector
make test-cover    # Run tests with coverage profile
make bench         # Run benchmarks
make lint          # Run golangci-lint
make fmt           # Format code
make vet           # Run go vet
make check         # Run fmt + vet + lint + test

MIT License. See LICENSE for details.