New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add support for PCAP "modified" format #35

Merged

chifflier merged 1 commit into rusticata:master from gcsbt:support-modified-format

Apr 15, 2024

Contributor

gcsbt commented Apr 11, 2024

Some outdated / proprietary tools seem to produce PCAPs in this format, described on Wireshark wiki:

The magic bytes for this format are 0xa1b2cd34 (note the final two bytes). The file header is otherwise the same as the standard libpcap header.

The record header is extended [...]

For PCAPs with this magic, the patch discards the 8 additional bytes from record headers.

The test case comes from a capture of an ICMP packet modified with editcap:

$ sudo tcpdump -i lo -w /tmp/ping.pcap
$ hexdump -n 4 -C /tmp/ping.pcap | head -1
00000000  d4 c3 b2 a1                                       |....|

$ editcap -F modpcap /tmp/ping.pcap /tmp/ping-modified.pcap
$ hexdump -n 4 -C /tmp/ping-modified.pcap | head -1
00000000  34 cd b2 a1                                       |4...|


          add support for PCAP "modified" format

1a8c632

chifflier merged commit e0232b0 into rusticata:master

5 of 7 checks passed

Member

chifflier commented Apr 15, 2024

Merged, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet