// package captures provides definitions and functions for parsing packet captures on the ASA package captures import ( "fmt" "regexp" "strconv" "strings" ) type Captures struct { Captures map[string]Capture `json:"captures"` } type Capture struct { Type string `json:"type"` Trace bool `json:"trace"` Interface string `json:"interface"` State string `json:"state"` Bytes int `json:"bytes"` Match []string `json:"matches"` } // ParseCaptures : parses raw output from 'show cap' command to multiple Capture structures func (c *Captures) Parse(raw string) error { //rawCaptures := make(map[string]Capture) c.Captures = make(map[string]Capture) innerReg := regexp.MustCompile(`\[(.*) - (\d+) bytes]`) reg := regexp.MustCompile(`capture (\S+) type (\S+) interface (\S+)`) traceReg := regexp.MustCompile(`capture (\S+) type (\S+) trace interface (\S+)`) var curCap string for _, line := range strings.Split(raw, "\n") { if line == "show cap" { // skip first line of a response continue } found := reg.FindStringSubmatch(line) if len(found) == 4 { var state string var bytes int f := innerReg.FindStringSubmatch(line) if len(f) == 3 { state = f[1] var err error bytes, err = strconv.Atoi(f[2]) if err != nil { return fmt.Errorf("error converting bytes '%s' to integer while parsing capture: %v", f[2], err) } } c.Captures[found[1]] = Capture{ Bytes: bytes, State: state, Interface: found[3], Type: found[2], } curCap = found[1] continue } found = traceReg.FindStringSubmatch(line) if len(found) == 4 { var state string var bytes int f := innerReg.FindStringSubmatch(line) if len(f) == 3 { state = f[1] var err error bytes, err = strconv.Atoi(f[2]) if err != nil { return fmt.Errorf("error converting bytes '%s' to integer while parsing capture: %v", f[2], err) } } c.Captures[found[1]] = Capture{ Bytes: bytes, State: state, Interface: found[3], Trace: true, Type: found[2], } curCap = found[1] continue } if strings.HasPrefix(line, " match") { if thisCap, ok := c.Captures[curCap]; ok { thisCap.Match = append(thisCap.Match, strings.TrimSpace(line)) c.Captures[curCap] = thisCap } } } return nil }