New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
pcapng enhancements (idb,epb) and some fixes #4342
Conversation
Based on draft-ietf-opsawg-pcapng-latest, 5 March 2024. -map packet.sniffed_on to unique IDB id. When writing, if_name option and linktype is populated based on the first packet seen with a unique sniffed_on string. -map packet.direction to EPB flags inbound/outbound direction bits. Remaining flag bits not implemented. -simplified RawPcapNgReader._read_options() and moved (code,value) treatment to the caller since codes of same type can have different meaning for different type of blocks. -Fix RawPcapNgReader._read_block_shb() and _write_block_shb(). *added new tests and adapted others to the changes
Co-authored-by: Guillaume Valadon <guillaume@valadon.net>
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #4342 +/- ##
==========================================
+ Coverage 81.67% 82.12% +0.44%
==========================================
Files 350 350
Lines 82884 83195 +311
==========================================
+ Hits 67699 68326 +627
+ Misses 15185 14869 -316
|
Unless specifically asked or discussed during a PR review process, we squash all commits. You can simply add more commits to apply changes.
|
@guedou, I have done some changes as per your review suggestion. Additionally added a length check for the tsresol option when reading IDB. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good to me. @gpotter2 can you do a second review?
- changes around self.linktype, so that attribute is always int (when exists) - other minor type hint fixes
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the PR ! This looks good
Checklist:
cd test && ./run_tests
ortox
)Based on draft-ietf-opsawg-pcapng-latest, 5 March 2024, I made following changes:
packet.sniffed_on
to unique IDB id. When writing, if_name option and linktype is populated based on the first packet seen with a unique sniffed_on string.packet.direction
to EPB flags inbound/outbound direction bits. Remaining flag bits not implemented.RawPcapNgReader._read_options()
and moved (code,value) treatment to the caller since codes of same type can have different meaning for different type of blocks.RawPcapNgReader._read_block_shb()
and_write_block_shb()
to be according to the draftNote: I couldn't figure the meaning of
packet.direction
on Scapy API reference or source code, but since it's marked as integer I assumed it follows the pcapng epb_flags outbound/inbound field.Why I did this changes:
I was using scapy to convert packet hex dump from a text file to pcap. The text file included information about interface name and direction (outbound/inbound) which I would like to to have included in the pcapng file.