Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

NETOBSERV-1850 fix cli enrichment issue #91

Merged
merged 1 commit into from
Sep 20, 2024
Merged

NETOBSERV-1850 fix cli enrichment issue #91

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 3 additions & 8 deletions cmd/packet_capture.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,12 +27,6 @@ var pktCmd = &cobra.Command{
Run: runPacketCapture,
}

type PcapResult struct {
Name string
PacketCount int64
ByteCount int64
}

func runPacketCapture(_ *cobra.Command, _ []string) {
go scanner()

Expand Down Expand Up @@ -146,8 +140,8 @@ func runPacketCaptureOnAddr(port int, filename string) {
// write enriched data as interface
writeEnrichedData(pw, &genericMap)

// then append packet to file
err = pw.WriteEnhancedPacketBlock(0, ts, b, types.EnhancedPacketOptions{})
// then append packet to file using totalPackets as unique id
err = pw.WriteEnhancedPacketBlock(totalPackets, ts, b, types.EnhancedPacketOptions{})
Copy link
Contributor

@msherif1234 msherif1234 Sep 20, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jpinsonneau how the total packet can be unique id ? why not startupTime ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I increase the totalPackets value each time we add a packet just below this call:

		totalPackets = totalPackets + 1

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah I saw that isn't that will be the case with other pkts u capture so if I received 2 udp pkts then 2 tcp pkts in two different runs won't that collide ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do you open the 2 pcapng files in one ? 🤔

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried the following code to see what happens:

err = pw.WriteEnhancedPacketBlock(uint32(startupTime.UnixMilli())+totalPackets, ts, b, types.EnhancedPacketOptions{})

And it seems wireshark is not expecting that. Here the id is an index related to the previously created interface description using WriteInterfaceDescription call:
image

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok I guess lets proceed as is thanks for confirming

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thank you for reviewing !

if err != nil {
log.Fatal(err)
}
Expand All @@ -166,6 +160,7 @@ func runPacketCaptureOnAddr(port int, filename string) {
log.Infof("Capture reached %s, exiting now...", sizestr.ToString(maxBytes))
return
}
totalPackets = totalPackets + 1

// terminate capture if max time reached
now := currentTime()
Expand Down
7 changes: 4 additions & 3 deletions cmd/root.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,9 +31,10 @@ var (
currentTime = func() time.Time {
return time.Now()
}
startupTime = currentTime()
lastRefresh = startupTime
totalBytes = int64(0)
startupTime = currentTime()
lastRefresh = startupTime
totalBytes = int64(0)
totalPackets = uint32(0)

mutex = sync.Mutex{}

Expand Down
Loading