f18m/large-pcap-analyzer

The tcpdump-like filter fails to read and match linux cooked captures (with link type SLL)

Opened this issue · 4 comments

beef9 commented

Executing:
$ large_pcap_analyzer captures.pcap -v -Y "src host X and src port Y" -w output_large_pcap/output.pcap on a 320MiB file yields:

Successfully compiled PCAP filter: src host X and src port Y
Analyzing PCAP file 'captures.pcap'...
The PCAP file has size 0.31GiB = 320MiB.
Successfully opened output PCAP 'output_large_pcap/output.pcap'
Processing took 0 seconds.
0M packets (939519 packets) were loaded from PCAP (matching PCAP filter).
0M packets (0 packets) matched the filtering criteria (search string / PCAP filters / TCP streams filter) and were saved into output PCAP.

I took the same file and converted all ethernet layers to correctly formatted ethernet headers (with src MAC and dst MAC addresses), and now it works:

Successfully compiled PCAP filter: src host X and src port Y
Analyzing PCAP file 'captures_edited.pcapng'...
The PCAP file has size 0.33GiB = 333MiB.
Successfully opened output PCAP 'output_large_pcap/output.pcap'
Processing took 0 seconds.
0M packets (939519 packets) were loaded from PCAP (matching PCAP filter).
0M packets (24312 packets) matched the filtering criteria (search string / PCAP filters / TCP streams filter) and were saved into output PCAP.

MHTTHM commented

hello， have you solved this problem?
I had the same problem now.

beef9 commented

@MHTTHM

hello， have you solved this problem?
I had the same problem now.

I used a tool compiled for windows, I can't remember the name now BUT I think I used the app named TraceWrangler.
This tool can convert linux cooked headers to ethernet pseudo headers, but I don't think it stores the actual MAC addresses. So if you don't care about them, just go with this app.

MHTTHM commented

@MHTTHM

hello， have you solved this problem?
I had the same problem now.

I used a tool compiled for windows, I can't remember the name now BUT I think I used the app named TraceWrangler.
This tool can convert linux cooked headers to ethernet pseudo headers, but I don't think it stores the actual MAC addresses. So if you don't care about them, just go with this app.

thank you for your help!

f18m commented

Support for Linux cooked header should not be difficult to add... it's not a priority for me though... patches are welcome :)