流量回放goreplay

1.网关权重\mirror旁路 (生产)

2.goreplay编译测试

<==============================
/usr/local/go/pkg/tool/linux_amd64/link: running gcc failed: exit status 1
/bin/ld: cannot find -lpthread
/bin/ld: cannot find -lc
===============================>
yum install glibc-static.x86_64 -y
<==============================
# github.com/google/gopacket/pcap
vendor/github.com/google/gopacket/pcap/pcap_unix.go:34:18: fatal error: pcap.h: No such file or directory
===============================>
https://www.tcpdump.org/#source
libpcap-1.10.1.tar.gz
./configure
make
make install
<==============================
git clone https://github.com/buger/goreplay.git
cd goreplay
make build
======================================
windows:
https://github.com/buger/goreplay/pull/940
https://github.com/buger/goreplay/wiki/Running-on-Windows
1.
--input-raw :8888 --input-raw-bpf-filter "port 8888"  --output-stdout
2.
--input-raw :8888 --input-raw-bpf-filter "port 8888"  --output-http "http://11.11.11.112:30010" --output-http-elasticsearch http://11.11.11.114:9200/idc_goreplay_record --output-http-track-response=true

linux:
elastigo---->elasticsearch7
cat go.mod
replace github.com/mattbaird/elastigo v0.0.0-20170123220020-2fe47fd29e4b => ./out/mattbaird/elastigo

	upstream goreplay {
        server 127.0.0.1:9000;# or other proxy
    }
	server {
        listen       9000;
        server_name  localhost;
		location / {
            default_type application/json;
			return 200 '{"status":"success","result":"nginx json"}';
        }
		
	}
	server {
        listen       8443 ssl;
        server_name  localhost;

        ssl_certificate      /opt/server.crt;
        ssl_certificate_key  /opt/server.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

		ssl_protocols SSLv2 SSLv3 TLSv1;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;
		
	
        location / {
			 mirror /mirror_gorepaly;
             proxy_pass http://11.11.11.114:30009/;
        }
		location = /mirror_gorepaly {
            internal;
			proxy_redirect     off;
            proxy_set_header   Host             $host;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
            proxy_pass http://goreplay$request_uri;
        }
    }

1.libpcap数据包
https://www.cnblogs.com/10087622blog/p/8320234.html 

2.goreplay
--input-raw-engine "libpcap"
如果http request数据包大于一定值，丢弃

--input-raw-override-snaplen 
65536+200



nohup ./gor --input-raw :4438  --output-http "" --http-allow-header host:.*xxx.*  --input-raw-override-snaplen  --output-http-elasticsearch http://username:123456@xxx:9200/goreplay_record  > gor.log.80 2>&1 &