Read Error (and doesn't stop)

[dcferreira]

Read Error (and doesn't stop)

[notti]

You are on the right track. The problem is indeed the interfaces: The capture length differs for both, which I think is illegal in a pcap (but not in pcapng - which this is). Sadly libpcap can only handle one interface, which means it just returns an error if it reads the first packet from a different interface (This is the read error).
You can also see this if you try tcpdump to read this file:

notti@apate:~/go/src/github.com/CN-TU/go-flows/tmp^master ±
% tcpdump -r merge_none.pcapng                                                                  18-02-01 - 19:55:28
reading from file merge_none.pcapng, link-type LINUX_SLL (Linux cooked)
tcpdump: pcap_loop: an interface has a snapshot length 262144 different from the type of the first interface

The hanging part is because of:

go-flows/packet/pcap.go

Lines 283 to 284 in a066f89

	log.Println("Error:", err)
	continue

Maybe we should change that to log.Fatal.

Well there are two options now:

• Don't merge the pcaps - you actually don't need to, since you can also provide multiple pcaps on the command line
• Fix the Capture length somehow
• Add support for a different pcapng input

[dcferreira]

Don't merge the pcaps - you actually don't need to, since you can also provide multiple pcaps on the command line

Ah, I wasn't aware. That's indeed the easiest quickfix for me. I assume they're read in the order they're given?
I'll try it out tomorrow (and also change the continue to stop).

[notti]

Yes they're read exactly in the order you provide them:

go-flows/run.go

Lines 436 to 438 in a066f89

	for _, fname := range arguments {
	time = buffer.ReadFile(fname)
	}

From a quick look everything should be fine except for the statistics:

go-flows/packet/pcap.go

Lines 308 to 309 in a066f89

	input.packetStats.packets = npackets
	input.packetStats.filtered = nfiltered

I think those should be += instead of =. But I think this statistics output is not that important

[dcferreira]

Fix was applied in a863da7. The exporter now crashes when an error is found.