admin/mandiant-gopacket
1
0
Fork 0
mirror of https://github.com/mandiant/gopacket synced 2026-06-21 13:57:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: document three-way build matrix in Platform Support

Browse Source 
Replaces the "Linux/macOS only, use WSL on Windows" note with a
table showing the three supported build configurations (default cgo,
CGO_ENABLED=0 Linux, Windows), which tools are available in each,
and which proxy path works. Also drops a stray reference to a
specific KNOWN_ISSUES section number that will drift over time.
This commit is contained in:
psycep
2026-04-22 10:46:52 -05:00
parent c3173c535a
commit 82b955638e
1 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+14 -7
View File
@@ -29,12 +29,19 @@ libpcap is missing, `install.sh` will skip those two and build the rest.
### Platform Support
Linux and macOS only. Native Windows builds (MSYS2/MINGW64, plain `go build`
on Windows) are **not supported** - `pkg/transport` uses libc's `connect()`
via cgo so that `LD_PRELOAD`-based proxies like proxychains can hook it,
which has no Windows equivalent. On Windows, use
[WSL](https://learn.microsoft.com/windows/wsl/install) and build from inside
the Linux environment.
gopacket builds on Linux, macOS, and Windows. The set of working tools and
available proxying paths depends on the build flags:
| Build | Tools available | Proxying |
|----------------------------------------|----------------------------------------|-----------------------------------------------------|
| Linux / macOS with cgo (default) | All 63 | proxychains (LD_PRELOAD) and/or `-proxy` SOCKS5 |
| Linux with `CGO_ENABLED=0` | 61 (`sniff`, `split` become stubs) | `-proxy` only (proxychains needs the libc hook) |
| Windows (`GOOS=windows CGO_ENABLED=0`) | 60 (`sniff`, `split`, `sniffer` stubs) | `-proxy` only (no `LD_PRELOAD` on Windows) |
`sniff` and `split` depend on libpcap via cgo; `sniffer` depends on Unix raw
sockets. When a tool can't be built for the target, gopacket substitutes a
stub that prints a clear message and exits 1, so `go build ./...` always
succeeds and the install layout is consistent across platforms.
To uninstall:
```bash
@@ -63,7 +70,7 @@ gopacket-secretsdump -proxy socks5h://127.0.0.1:1080 'domain/user:password@targe
ALL_PROXY=socks5h://127.0.0.1:1080 gopacket-smbclient 'domain/user:password@target'
```
UDP-dependent features are **disabled** under `-proxy` rather than silently leaking packets (SOCKS5 UDP ASSOCIATE is rarely supported by proxies, and bypassing the proxy for UDP would reveal the attacker's real source IP). Affected features and their workarounds are documented in [KNOWN_ISSUES.md #9](KNOWN_ISSUES.md).
UDP-dependent features are **disabled** under `-proxy` rather than silently leaking packets (SOCKS5 UDP ASSOCIATE is rarely supported by proxies, and bypassing the proxy for UDP would reveal the operator's real source IP). Affected features and their workarounds are documented in [KNOWN_ISSUES.md](KNOWN_ISSUES.md).
**Chaining:** `-proxy` is compatible with proxychains. The TCP connection to the SOCKS5 proxy itself still goes through libc `connect()`, so `proxychains → gopacket → -proxy → target` works for nested routing scenarios.