franklindyer/pcap-stream-monitor

Some tools in C that facilitate tracking traffic streams, built using libpcap.

pcap-stream-monitor's Issues

Sequential search when looking up flows

Currently, sequential search is used for flow lookup. A better option would be to use an ordered flow list with something like binary search, or, even better, a hash table. Fix this, while preserving modularity (that is, it should be possible to use whatever lookup method one prefers).

It would be nice to also have some sort of test suite for comparing the efficiency of different data structures for flow lookup.

Storage of dead flows is inefficient

For larger captures, it's not feasible to store all dead flows in a linked list without flushing this linked list regularly. On the other hand, it doesn't make much sense to interrupt the process of packet capture to flush this linked list, which could take a long time if the list is large. Instead, there should be a separate thread (perhaps a child process of the capturing process) that takes care of flushing dead flow records to output files. Figure out how to set this up.

pcap_lookupdev is deprecated

Persistent warning pcap_lookupdev is deprecated when compiling using the makefile. Figure out how to use pcap_findalldevs to avoid this deprecated function usage.

Reading ICMP headers

Reading ICMP headers is not yet supported. Add a struct for this analogous to those used for TCP and UDP headers.