New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
.findx file not written in real-time #243
Comments
You'll need to look at the code. My suspicion is that the .findex file is written when the tcpstream is closed. Do you have pcap file that you can distribute that replicates the problem, or can you replicate it with one of the pcap files at https://digitalcorpora.org/ ? |
This problem only occurs during live capture where my captured session stays open. I just ran: I saw in the code that the index file is sorted before closing, I guess that's the issue then. |
Well, it looks like you have a bunch of SSH sessions. Are they long-lived? The file should be written when the session is closed. |
You could probably add an option to disable t he sorting and write incrementally, if that's something you need. |
When I do a live capture on an interface I see that tcpflow writes the output/data file every second, but the .findx file (command line option
-I
) just stays at 0 bytes:It seems it gets only written once I stop the program.
This makes it impossible for me to get timestamps for the data I'm interested in while I run the capture.
I observe this behaviour both with version 1.4.5 and 1.6.1
Is this a bug or done on purpose?
The text was updated successfully, but these errors were encountered: