Hacker Newsnew | past | comments | ask | show | jobs | submitlogin



Does that help? I don't want to replay the packets on a network. Instead, I want to feed them to my library without having to deal with reconstructing the TCP stream from the packets myself. I don't see anything for that in that suite.

tcpflow (mentioned in another thread here) seems much closer in that it does reconstruct TCP flows from pcap, but it doesn't timestamp stuff (it'd be nice to have an idea if some client->server data or some server->client data came first as well as just relate to timeouts), and I'd prefer to put everything in one file (both directions of TCP data, UDP packets).

Maybe I "just" need to figure out that Rust library I mentioned in the grandparent, and maybe create my own intermediate format that has just the data I want for my library. (I can discard TCP retransmissiony stuff, MACs, etc. to focus on what a library sees through the kernel socket interfaces.)


   tcpflow stores all captured data in files that have names of the form:

   [timestampT]sourceip.sourceport-destip.destport[--VLAN][cNNNN]
   where: timestamp is an optional timestamp of the time that the first packet was seen
https://github.com/simsong/tcpflow/blob/master/doc/tcpflow.1...

   .B t
   Prepends each filename with a Unix timestamp (seconds since epoch).
   .B T
   Prepends each filename with an ISO-8601 timestamp.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: