draft-ietf-opsawg-pcap VS gopacket

eCapture implements the feature of saving a pcapng file by eBPF TC, and supports TLS Master Secret Key capturing by eBPF Uprobe. Also, gopacket's DSB feature is supported, based on Decryption Secrets Block (DSB)

I have seen pcap but not packetz, thanks. Pcap looks unfinished and packetz has not been updated in a long time, but they might be able to make a working capture program. However the popularity and features available in Go regarding packet capture makes it very hard to beat. E.g. the Google gopacket library has 5.6k stars on github and as pretty much every feature you'd want for this sort of stuff built in.

eCapture implements the feature of saving a pcapng file by eBPF TC, and supports TLS Master Secret Key capturing by eBPF Uprobe. Also, gopacket's DSB feature is supported, based on Decryption Secrets Block (DSB)

Well, there is https://github.com/google/gopacket/, you have a package that uses CGo, `pcap`, and then there is `pcapgo`, native Go implementation. Doesn't have all the features but in my case, I was able to use it and remove CGo.

I will capturing TCP packets by gopacket/pcap.

For example, gopacket uses libpcap by default for capturing the traffic. Libpcap doesn't support network namespaces and we can't ask it to listen to traffic on a different namespace. However, we can change the network namespace of the calling thread and then start libpcap to see the traffic on a different namespace.

https://pkg.go.dev/github.com/google/gopacket/routing - Linux only and not working correctly and not actively maintained