- Add Timestamp time.Time field to ClassifiedPacket (classify/types.go)
- Create capture/bpf.go: ValidateBPFFilter and CompileSoftwareBPF
- Create capture/pcap_reader.go: ReadPcapFile with optional software BPF filter
- Update OpenCapture and StartCapture to accept filter string param
- Update cmd/netsynth/main.go to pass empty filter to StartCapture
- All new tests pass; existing tests unaffected
- ListInterfaces uses net.Interfaces() stdlib (no pcap dependency for listing)
- OpenCapture wraps packetcap/go-pcap with platform-specific permission error handling
- StartCapture uses buffered channel (512) with atomic drop counter
- Dynamic link type detection via layers.LinkType(handle.LinkType())
- Linux error shows setcap cap_net_raw+ep hint; macOS shows sudo hint
- Add github.com/packetcap/go-pcap v0.0.0-20251215 to go.mod
- TestListInterfaces: verifies net.Interfaces() returns at least 1 interface
- TestListInterfacesFormat: verifies interface Name is non-empty
- TestIsPermissionError: table-driven positive cases for perm error detection
- TestIsPermissionErrorNegative: non-perm errors not flagged
- TestPermissionErrorMsg: verifies sudo + interface name + Linux setcap hint
gurix