Feature #432
openPCAP-NG support
Added by Victor Julien over 14 years ago. Updated 17 days ago.
VJ Updated by Victor Julien over 14 years ago Actions #1
- Status changed from New to Assigned
- Assignee set to Eric Leblond
VJ Updated by Victor Julien almost 14 years ago Actions #2
- Target version changed from 1.4 to 1.4beta2
EL Updated by Eric Leblond almost 14 years ago Actions #3
- % Done changed from 0 to 100
It is already working with at least pcap v1.3.0 (version since 2010 should work if we trust website).
It is enough to do:
bin/suricata -r ~eric/git/oisf/benches/sample-wlan0.pcapng
to have a correct parsing of sample-wlan0.pcapng which is a pcap-ng 1.0 file:
file ~eric/git/oisf/benches/sample-wlan0.pcapng /home/eric/git/oisf/benches/sample-wlan0.pcapng: pcap-ng capture file - version 1.0
EL Updated by Eric Leblond almost 14 years ago Actions #4
- % Done changed from 100 to 30
Suricata could have some issues when multiple interfaces (with different datalink) are used in the file.
EL Updated by Eric Leblond almost 14 years ago Actions #5
This case is not supported by libpcap (example file can be provided privately)
Do we try a completely different approach (like using a new library) ?
VJ Updated by Victor Julien almost 14 years ago Actions #6
So libpcap 1.3 supports pcap NG but not all features? Is it on their roadmap?
EL Updated by Eric Leblond almost 14 years ago Actions #7
It is not mentioned in any feature request (http://sourceforge.net/tracker/?group_id=53067&atid=469580). It is possible this is not planned at all as it will break some important part of the API. For example, pcap_datalink() which is used by suricata as a pcap handle argument. This is not good in pcap-ng where the datalink can depends on the packet (and need to be updated for each packets).
Currently, when running in pcap mode with a file with two different interfaces (on Ethernet and one tuntap iface), we've got this:
[5722] 10/9/2012 -- 17:50:19 - (source-pcap-file.c:188) <Error> (ReceivePcapFileLoop) -- [ERRCODE: SC_ERR_PCAP_DISPATCH(20)] - error code -1 an interface has a type 12 different from the type of the first interface
pcap detects the problem but do not support the feature.
VJ Updated by Victor Julien almost 14 years ago Actions #8
Does wireshark support this? If so, how?
EL Updated by Eric Leblond almost 14 years ago Actions #9
Victor Julien wrote:
Does wireshark support this? If so, how?
Wireshark does it with a non-exportable code. They've got a library to parse some fromat but libpcap-ng seems to be parsed with non in-core code.
VJ Updated by Victor Julien almost 14 years ago Actions #10
Like we discussed in person yesterday, we'll go with the libpcap 1.3+ pcap-ng support for now. If the need comes up we can consider adding more complete support.
VJ Updated by Victor Julien almost 14 years ago Actions #11
- Target version changed from 1.4beta2 to TBD
- % Done changed from 30 to 50
GH Updated by Guy Harris almost 12 years ago Actions #12
FYI:
At some point, in my Copious Free Time(TM), I want to add new APIs to libpcap that support the full capabilities of pcap-ng. The routines implementing those APIs will also be able to read pcap files transparently, so if code is changed to use the new APIs, it will still be able to read pcap files. However, to support the full capabilities of pcap-ng, a program or library would have to be changed. The old APIs will continue to be supported, with the existing limitations.
I have no schedule for that; see the previous reference to Copious Free Time. :-)
Wireshark's code to read pcap-ng is in the same place in the source code as the other code to read file formats - the wiretap subdirectory, in wiretap/pcapng.c. However, neither the API to libwiretap nor the interface between code to read file formats and the libwiretap core is stable.
VJ Updated by Victor Julien about 8 years ago Actions #13
- Assignee changed from Eric Leblond to Anonymous
- Effort set to medium
- Difficulty set to medium
AH Updated by Andreas Herz over 7 years ago Actions #14
- Assignee set to Community Ticket
VJ Updated by Victor Julien almost 7 years ago Actions #15
- Status changed from Assigned to New
Its interesting (and a bit annoying) that over 7 years after this issue we still have platforms in which libpcap apparently doesn't support pcap-ng files. Recently we've gotten reports from ppl using OpenBSD and I've see it myself on MinGW with I think npcap.
VJ Updated by Victor Julien over 5 years ago Actions #16
A suggestion at the 2020 brainstorm was to use a pcap-ng rust crate.
PA Updated by Philippe Antoine 17 days ago Actions #17
- Status changed from New to Triaged