Hej,
i recently stumbled upon this marvellous library and now i plan to build
an analysis tool which will be based on jNetPcap. This tool should
analyse and capture live traffic like Wireshark but with a slightly different focus.
(I don't want to build a second protocol dissector but focus more on the flow and session analysis.)
One requirement for this tool would be a relatively small memory footprint
but with the possibility to see the content of every captured packet on demand.
I.e. i don't want to store all the packets in the memory but nevertheless need fast access on every captured packet.
Now i wonder if there is any best practice how to achieve that.
The two possible solutions i encountered:
Receive, analyze every packet and then:
1. Store every packet immediately on the disc with the PcapDumper.dump() method and read this dump on demand (e.g. with the jNetStream-API) !?
or
2. Store the packets immediately on a DB and read on demand from the DB.
(-> this approach leads to further questions, like which DB to use, relational, OR, OO etc. )
Are there any other solutions? Has somebody tried something like this already?
I'm very happy for every feedback, hint, proposal, critique ...
Best regards
Philipp