mac resolution

engine/tcp.go

@@ -27,7 +27,8 @@ const (
 
 type tcpContext struct {
 	*gopacket.PacketMetadata
-	Verdict tcpVerdict
+	Verdict        tcpVerdict
+	SrcMAC, DstMAC net.HardwareAddr
 }
 
 func (ctx *tcpContext) GetCaptureInfo() gopacket.CaptureInfo {
@@ -46,9 +47,12 @@ type tcpStreamFactory struct {
 func (f *tcpStreamFactory) New(ipFlow, tcpFlow gopacket.Flow, tcp *layers.TCP, ac reassembly.AssemblerContext) reassembly.Stream {
 	id := f.Node.Generate()
 	ipSrc, ipDst := net.IP(ipFlow.Src().Raw()), net.IP(ipFlow.Dst().Raw())
+	ctx := ac.(*tcpContext)
 	info := ruleset.StreamInfo{
 		ID:       id.Int64(),
 		Protocol: ruleset.ProtocolTCP,
+		SrcMAC:   append(net.HardwareAddr(nil), ctx.SrcMAC...),
+		DstMAC:   append(net.HardwareAddr(nil), ctx.DstMAC...),
 		SrcIP:    ipSrc,
 		DstIP:    ipDst,
 		SrcPort:  uint16(tcp.SrcPort),