Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement PCAPdroid trailer equivalent in pcapng #434

Open
emanuele-f opened this issue May 6, 2024 · 0 comments
Open

Implement PCAPdroid trailer equivalent in pcapng #434

emanuele-f opened this issue May 6, 2024 · 0 comments
Labels
enhancement New feature or request
Milestone

Comments

@emanuele-f
Copy link
Owner

emanuele-f commented May 6, 2024

Currently the PCAPdroid trailer is not supported with the pcapng dump format.
Contrary to PCAP, the pcapng format is extensible so it's not needed to add fake ethernet header and trailer to it. Instead, it's possible to define some custom blocks.

One block type, for example, could contain the uid -> package_name mappings, which would save a lot of space in the capture (currently the package name takes 20 bytes per packet). Another block could then specify just the UID for a given connection (just 4 bytes).

@emanuele-f emanuele-f added the enhancement New feature or request label May 6, 2024
@emanuele-f emanuele-f changed the title Add PCAPdroid trailer to pcapng Implement PCAPdroid trailer equivalent in pcapng May 15, 2024
@emanuele-f emanuele-f added this to the 1.8.0 milestone May 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant