[已解决] Golang中使用Gopacket/pcap处理Windows设备名称的问题

问题在于Windows设备名称的格式。在Windows上，pcap.OpenLive()需要的是npcap的设备名称格式，而不是标准的网络接口名称。

以下是修正后的代码：

package main

import (
	"fmt"
	"log"
	"time"

	"github.com/google/gopacket"
	"github.com/google/gopacket/pcap"
)

var (
	snapshotLength int32         = 65535
	promiscuous    bool          = false
	timeout        time.Duration = -1 * time.Second
)

func main() {
	// 获取所有网络设备
	devices, err := pcap.FindAllDevs()
	if err != nil {
		log.Fatal("FindAllDevs error:", err)
	}

	// 查找名为"Ethernet"的设备
	var deviceName string
	for _, device := range devices {
		if device.Name == "\\Device\\NPF_{你的设备GUID}" || device.Description == "Ethernet" {
			deviceName = device.Name
			fmt.Printf("Found device: %s (Description: %s)\n", device.Name, device.Description)
			break
		}
	}

	if deviceName == "" {
		// 列出所有可用设备供参考
		fmt.Println("Available devices:")
		for _, device := range devices {
			fmt.Printf("Name: %s, Description: %s\n", device.Name, device.Description)
		}
		log.Fatal("Device 'Ethernet' not found")
	}

	// 打开设备 - 使用pcap返回的设备名称
	handle, err := pcap.OpenLive(deviceName, snapshotLength, promiscuous, timeout)
	if err != nil {
		log.Fatal("OpenLive error:", err)
	}
	defer handle.Close()

	fmt.Printf("Successfully opened device: %s\n", deviceName)

	packetSource := gopacket.NewPacketSource(handle, handle.LinkType())

	// 设置超时，避免无限等待
	timeoutChan := time.After(5 * time.Second)
	
	select {
	case packet := <-packetSource.Packets():
		fmt.Printf("Captured packet: %v\n", packet)
	case <-timeoutChan:
		fmt.Println("Timeout: No packet captured within 5 seconds")
	}
}

或者，更简单的版本，直接使用pcap查找设备：

package main

import (
	"fmt"
	"log"
	"strings"
	"time"

	"github.com/google/gopacket"
	"github.com/google/gopacket/pcap"
)

func main() {
	// 获取所有设备
	devices, err := pcap.FindAllDevs()
	if err != nil {
		log.Fatal(err)
	}

	// 查找包含"Ethernet"描述的接口
	var targetDevice pcap.Interface
	for _, device := range devices {
		if strings.Contains(strings.ToLower(device.Description), "ethernet") {
			targetDevice = device
			break
		}
	}

	if targetDevice.Name == "" {
		log.Fatal("Ethernet device not found")
	}

	// 使用pcap的设备名称打开
	handle, err := pcap.OpenLive(targetDevice.Name, 65535, false, -1*time.Second)
	if err != nil {
		log.Fatal(err)
	}
	defer handle.Close()

	fmt.Printf("Listening on %s (%s)\n", targetDevice.Description, targetDevice.Name)

	packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
	for packet := range packetSource.Packets() {
		fmt.Println(packet)
		break // 只捕获一个包
	}
}

关键点：

1. Windows上npcap的设备名称格式为\Device\NPF_{GUID}，不是简单的Ethernet
2. 使用pcap.FindAllDevs()获取正确的设备名称
3. 通过设备描述(Description)来匹配"Ethernet"，然后使用返回的Name字段

运行代码前，先查看实际的设备名称：

devices, _ := pcap.FindAllDevs()
for _, d := range devices {
    fmt.Printf("Name: %s, Description: %s\n", d.Name, d.Description)
}