Packet Decoding

reading from offline file slow

Hi there,
I am using this code

...
pcap.loop(numFrames, new JPacketHandler() {
public void nextPacket(JPacket packet, StringBuilder errbuf) {

// final Tcp tcp = new Tcp();
// final Udp udp = new Udp();
// final Ip4 ip = new Ip4();

if (hasHeaders(packet)) {
frameData.add(new Frame("timestamp", "source ip", "destination ip", "protocol", packet.getTotalSize(), "payload" ));
}

}

}, errbuf);

...

to load packets from an offline file, but it takes around 7 minutes to load files with 100mb (around 730k packages). Is there any way to up the performance or am I stuck with it? Sorry I'm a beginner.

Also what would be the smartest way to get the data mentioned in the code from the packet?

Using jnetpcap 1.4r1425 on 64 bit W7
Thank you very much!

How to transform .dump to .pcap?

I am working on a packet decoding project. A part of work is to read packet size from .pcap files and .dump files. However, my codes are doing well in .pcap files but not work in .dump files. For example, when I use packet.size() on .pcap files, the results are correct. Using packet.size() on .dump files, comes out 42 bytes, however, there is no 42 bytes packet in the file. Is there any methods to transform .dump files to .pcap files or packet.size() in .dump files is wrong used? Thank you.

How to transform .dump to .pcap?

I am working on a packet decoding project. A part of work is to read packet size from .pcap files and .dump files. However, my codes are doing well in .pcap files but not work in .dump files. For example, when I use packet.size() on .pcap files, the results are correct. Using packet.size() on .dump files, comes out 42 bytes, however, there is no 42 bytes packet in the file. Is there any methods to transform .dump files to .pcap files or packet.size() in .dump files is wrong used? Thank you.

What is the optimal value to use for the loop count when calling pcap loop?

Originally my program was using a value of 100 and the pcap.loop was working properly when receiving ~10k pps. When I modified the loop call to be use the infinite value (-1) I noticed that packets were not being processed after ~15 mins when processing ~10k pps. The implementation just seemed to hang in the loop method and did not process any more packets. I was also using a timeout of 1000 when calling the pcap.openlive method, is this not an optimal value?

SctpData header does not decode multiple SCTP data chunks from bundled SCTP packet.

My application is receiving an SCTP packet with multiple data chunks and I am wondering why the following logic is not decoding the multiple data chunks properly:

PcapPacketHandler jpacketHandler = new PcapPacketHandler() {

@Override
public void nextPacket(PcapPacket packet, String user) {
//user defined headers that are registered properly
GREHeader greHeader = new GREHeader();
ERSPANHeader erspanHeader = new ERSPANHeader();
try {
if (packet.hasHeader(greHeader)) {
packet.getHeader(greHeader);
if (packet.hasHeader(erspanHeader)) {

JPacket jpacket = new JMemoryPacket(Ethernet.ID, erspanHeader.getPayload());
Iterator sctpData = jpacket.iterator(SctpData.class);
//only loops once even though there are 4 data chunks
while (sctpData.hasNext()) {

SctpData current = sctpData.next();
//returns a payload length of all the data chunks
current.getPayloadLength();
}
}
}
} catch (Throwable ex) {
}
}
};

Syndicate content