question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Support importing PCAP files

See original GitHub issue

Prerequisites

Description

v2.0.0-rc2 Unable to import pcap files directly from wireshark

Steps to Reproduce

  1. Capture files in wireshark and save
  2. Use File>Import to attempt to upload .pcap files
  3. No option in File>Import
  4. If attempt is made through the >File>Open then it is not read correctly

Expected behaviour: [What you expect to happen] File to open much the same as a .csv would

Actual behaviour: [What actually happens] If an attempt is made ot open te file through the File>Open path the follwoing is displayed:

image

If the user selects proceed, the following is displayed:

image

Reproduces how often: [What percentage of the time does it reproduce?] 100%

Additional Information

Any additional information, configuration or data that might be necessary to reproduce the issue.

Issue Analytics

  • State:closed
  • Created 3 years ago
  • Comments:12

github_iconTop GitHub Comments

1reaction
serpens24commented, Aug 18, 2020

Have started initially, by prototyping the pkts library (https://github.com/aboutsip/pkts) which produced the following results with the first sample dataset I downloaded - fuzz-2006-06-26-2594.pcap: image

However I have found some other sameple files throwing exceptions, which seems to relate potentially to packets not identified as TCP or UDP in Wireshark … although I need to confirm this.

There are other libraries worth trying, such as https://sourceforge.net/projects/jnetpcap/ which I intend to try before moving on to diagnose any pkts errors.

https://stackoverflow.com/questions/26978618/java-pcap-file-parser-library describes a few of the packages.

I tried including jnetpcap - it doesn’t reside in either of the current configured repos (central.maven.org, or repo.osgeo.org, but in https://clojars.org/repo/). I tried configuring this repo in ivysettings.xml and ivy.xml, but I get errors indicating the required package “<dependency org="jnetpcap" name="jnetpcap" rev="1.4.r1425-1g"/>” cant be found. I’m unsure why as manually entering the url indicted in the netbeans install log does resolve to valid files.

0reactions
arcturus2commented, Nov 10, 2020

Again, thank you for this work @serpens24 and to also contributing it to the ACSC Cyber repo (https://github.com/AustralianCyberSecurityCentre/constellation_cyber_plugins/pull/4). I’ll look to create a new version of Constellation and the Cyber version soon.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Import .pcap Files - ADM Help Centers
Select a .pcap file stored in the file system. For REST services, select a specific URI space to import the data into. In...
Read more >
8.3. Import PCAP dumps - Trisul Documentation
Trisul is capable of importing giant packet capture (PCAP) dumpfiles. The key capabilties of Trisul' PCAP import feature are: File or directory including...
Read more >
so-import-pcap — Security Onion 2.3 documentation
so-import-pcap will import one or more pcaps into Security Onion and preserve original timestamps. It will do the following: ... In addition to...
Read more >
Import and export PCAP files with nanosecond timestamps
A workaround, for now, is to directly use tcpdump ( --time-stamp-precision=nano ) or tshark ( --time-stamp-type <type> ) for capturing packets.
Read more >
PCAP Files - TechDocs
Select Menu > Capture > Import PCAP. · Click New. · For Import from, specify the import device. · Indicate whether to share...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found