#cgo solaris LDFLAGS: -L /opt/local/lib -lpcap
#cgo linux LDFLAGS: -lpcap
#cgo dragonfly LDFLAGS: -lpcap
#cgo freebsd LDFLAGS: -lpcap
#cgo openbsd LDFLAGS: -lpcap
#cgo netbsd LDFLAGS: -lpcap
#cgo darwin LDFLAGS: -lpcap

// 使用gopacket 抓包的簡(jiǎn)單示例
package main

import (
	"github.com/google/gopacket"
	"github.com/google/gopacket/layers"
	"github.com/google/gopacket/pcap"
	logger "github.com/sirupsen/logrus"
	"log"
)

const (
	device  = "ens32"
	SnapLen = int32(65535) // libpcap 接收數(shù)據(jù)的長(zhǎng)度
	Promisc = false        // 是否開(kāi)啟混雜模式
	BPF     = "icmp"
)

func main() {
	handle, err := pcap.OpenLive(device, SnapLen, Promisc, pcap.BlockForever)
	if err != nil {
		log.Fatal(err)
	}
	defer handle.Close()

	// 編譯并設(shè)置bpf過(guò)濾規(guī)則
	if err = handle.SetBPFFilter(BPF); err != nil {
		log.Fatal(err)
	}

	// 開(kāi)始獲取流量
	packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
	packetSource.NoCopy = true
	packetChan := packetSource.Packets()

	for packet := range packetChan {
		if packet.TransportLayer() == nil {
			// icmp流量
			icmpStreamHandle(packet)
		} else if packet.TransportLayer().LayerType() == layers.LayerTypeTCP {
			// tcp流量
			tcpStreamHandle(packet)
		} else if packet.TransportLayer().LayerType() == layers.LayerTypeUDP {
			// udp流量
			udpStreamHandle(packet)
		}
	}
}

func icmpStreamHandle(packet gopacket.Packet) {
	logger.Info("get icmp packet")
}
func tcpStreamHandle(packet gopacket.Packet) {
}
func udpStreamHandle(packet gopacket.Packet) {
}

[root@localhost ddk]# go build main.go && ldd main
	linux-vdso.so.1 =>  (0x00007ffe965f3000)
	libpcap.so.1 => /lib64/libpcap.so.1 (0x00007f6be101f000)
	libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f6be0e03000)
	libc.so.6 => /lib64/libc.so.6 (0x00007f6be0a35000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f6be1260000)
[root@localhost ddk]# 

yum install -y gcc flex byacc
cd /usr/local/source
wget http://www.tcpdump.org/release/libpcap-1.9.1.tar.gz
tar zxvf libpcap-1.9.1.tar.gz
cd libpcap-1.9.1 && ./configure && make

[root@localhost ddk]# CGO_LDFLAGS="-g -O2 -L/usr/local/source/libpcap-1.9.1 -I/usr/local/source/libpcap-1.9.1" go build -ldflags '-w -s' -o main main.go
[root@localhost ddk]# ldd main
	linux-vdso.so.1 =>  (0x00007fff6cde4000)
	libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f1e767fa000)
	libc.so.6 => /lib64/libc.so.6 (0x00007f1e7642c000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f1e76a16000)
[root@localhost ddk]#