Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Parse info, source, destination, etc. when using ek mode #574

Open
miaotony opened this issue Jul 11, 2022 · 0 comments
Open

Parse info, source, destination, etc. when using ek mode #574

miaotony opened this issue Jul 11, 2022 · 0 comments

Comments

@miaotony
Copy link
Contributor

Is your feature request related to a problem? Please describe.
I would like to get both detailed decoding info (including raw packet) and summary info (like one row in wireshark GUI), however from what I have tried in JSON / PDML / PSML mode tshark cannot provide both info. (If I'm not mistaken...

After trying EK mode with parameters -P -V -x, I surprisingly find that it provides what I want.

图片

Describe the solution you'd like
When using EK mode, provide some interfaces/functions or a dict containing the other fields besides layers.

Describe alternatives you've considered
When parsing raw json_pkt, the code only pick layers for further parsing and the other fields are ignored.

图片

def packet_from_ek_packet(json_pkt):
if USE_UJSON:
pkt_dict = ujson.loads(json_pkt)
else:
pkt_dict = json.loads(json_pkt.decode('utf-8'))
# We use the frame dict here and not the object access because it's faster.
frame_dict = pkt_dict['layers'].pop('frame')
layers = []
for layer in frame_dict['frame_frame_protocols'].split(':'):
layer_dict = pkt_dict['layers'].pop(layer, None)
if layer_dict is not None:
layers.append(EkLayer(layer, layer_dict))
# Add all leftovers
for name, layer in pkt_dict['layers'].items():
layers.append(EkLayer(name, layer))
return Packet(layers=layers, frame_info=EkLayer('frame', frame_dict),
number=int(frame_dict.get('frame_frame_number', 0)),
length=int(frame_dict['frame_frame_len']),
sniff_time=frame_dict['frame_frame_time_epoch'],
interface_captured=frame_dict.get('rame_frame_interface_id'))

Maybe you can add a dict in Packet class and set its default value to None to include the other fields meanwhile keeping compatibility.

BTW, you have to pay attention to pass -P -V parameters to tshark, just like LiveRingCapture in #573 .

Thank you very much!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant