How to associate pcap.Interface with net.Interface?

[irfabid]

Hi,

As mentioned in subject, I am trying to figure out which pcap.Interface represents which net.Interface

As I understand pcap.Interface is actually a hardware device, while net.Interface is a network connection (ie. a logical construct in Windows to control hardware device).

Is the only way to associate them together using IP Address? (suprisingly, pcap.Interface doesn't expose Hardware Address field)

I am looking for a better way to associate them together. Perhaps based on interface index? (couldn't find it in pcap.Interface)

[irfabid]

Looking at source code of pcap.go, I saw that Handle has an unexported deviceIndex field. Can we export it but keep it read-only? (i.e. a method on *Handle which returns deviceIndex)

@gconnell any thoughts?

[gconnell]

I think just changing it deviceIndex -> DeviceIndex should be fine. Hopefully it actually matches with the net.Interface indexes :-/

[irfabid]

It doesn't. At least not on Windows. I believe, it will never match on Windows with current code. That is because net.Interface refers to network connections and pcap.Interface refers to NIC. Their names are always different and current code tries to match them based on name.

I will test on Linux to get a complete picture, and then we will see how we can solve this.

[gconnell]

Awesome, thanks for looking into this!

…

On Mon, May 28, 2018 at 12:20 AM, Irfan Abid ***@***.***> wrote: It doesn't. At least not on Windows. I believe, it will never match on Windows with current code. That is because net.Interface refers to network connections and pcap.Interface refers to NIC. Their names are always different and current code tries to match them based on name. I will test on Linux to get a complete picture, and then we will see how we can solve this. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#456 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABJ9tsEfx1MZGQLcRLx4CiF_WyU22GAfks5t25dIgaJpZM4UGBUa> .

[extrame]

hello, any update on this issue? I am face the same problem in project... @gconnell @irfabid

[akkuman]

use pcap.FindAllDevs() can get the name which contains "Device\NPF_"

[ChenYahui2019]

use pcap.FindAllDevs() can get the name which contains "Device\NPF_"

The bug is about deviceIndex rather than name.

[Insolent-M1nx]

Any updates to this? Having the same issue with Windows devices.

[codeyourweb]

I had the same problem. I solved it by matching the IP addresses of the interfaces with those of the devices. It is certainly not the most elegant solution, but it works.

Here is an implementation of this solution in the arpscan.go:
https://github.com/codeyourweb/gopacket/blob/master/examples/arpscan/arpscan.go

[lylest]

Facing same problem here i think window have not properly handled it