jmakov/gulp

Lossless Gigabit Remote Packet Capture With Linux

gulp's Issues

net.core.rmem_default too small?

Hello Jernej,

the value of rmem_default is just 1/10 of the default in tcp_rmem (12582912 vs 125829120) is this intended or a typo?

gulp/scripts/install.sh

Lines 31 to 32 in 33fcc15

	echo 'net.core.rmem_default=12582912' | $SYSCTL_APPEND_COMMAND
	echo 'net.ipv4.tcp_rmem= 12582912 125829120 1258291200' | $SYSCTL_APPEND_COMMAND

Regards,
Carsten

gulp requires root to run

The following settings are apparently insufficient:

sudo groupadd pcap
sudo usermod -a -G pcap $USER
sudo chgrp pcap gulp
sudo setcap cap_net_raw,cap_net_admin=eip gulp

since we still get this output when running gulp without sudo:

./gulp: Warning: could not lock ring buffer into RAM
./gulp: Reader could not set scheduling priority: Permission denied

Compress stream before writing to disk

This option would allow you to pipe captured stream and process it in-line, before saving it to a file. A use case is saving disk bandwidth using a fast compressor e.g. snappy before saving (from the-tcpdump-group/tcpdump#458).

How to use pcap file as input instead of interface

Hello,

I have a tcpdump capture of erspan traffic.
I would like to pass it through gulp to decapsulte the erspan headers
and output the result back into a pcap file for further analysis with wireshark.

How can I do that?

Thanks,

Handle ^C interrupts with "-Z" flag

Interrupting with ^C when using "-Z" flag results in "No such file or directory" messages if the script didn't yet finish.

create pcap file "per flow"

I would like to have a pcap file created for each src-ip:port/dst-ip:port combination, or just ip address at a minimum, for all tcp and udp packets. I am not a c++ developer but I was able to make this work in principle with a test program. here's the relevant part of the code:

` if (ip->ip_p == 6 /* tcp protocol number */) {
//printf("\ntcp!\n");

        char srcname[100];
        strcpy(srcname, inet_ntoa(ip->ip_src));
        char dstname[100];
        strcpy(dstname, inet_ntoa(ip->ip_dst));
        
        
        int &stored_val = map[dstname];
        
        
        oss << "/" << odest << "/"<< dstname << "-" << stored_val << ".pcap";
        pfile = oss.str();

        if (GetFileSize(pfile) >= 0) {
            dumpfile= pcap_dump_open_append(fp, pfile.c_str());
        }
        else {
            dumpfile= pcap_dump_open(fp, pfile.c_str());
            
        }
        pcap_dump((unsigned char *) dumpfile, header, pkt_data);
        
        
    }

    else if (ip->ip_p == 17 /* tcp protocol number */) {
        //printf("\nudp!\n");
        

        char srcname[100];
        strcpy(srcname, inet_ntoa(ip->ip_src));
        char dstname[100];
        strcpy(dstname, inet_ntoa(ip->ip_dst));
        
        
        int &stored_val = map[dstname];
        
        oss << "/" << odest << "/"<< dstname << "-" << stored_val << ".pcap";
        pfile = oss.str();

        if (GetFileSize(pfile) >= 0) {
            dumpfile= pcap_dump_open_append(fp, pfile.c_str());
        }
        else {
            dumpfile= pcap_dump_open(fp, pfile.c_str());
            
        }
        `

My program loses a lot of packets under load however, hence why I looked to yours for some insipiration on how to optimize. This is all still quite a bit over my head though. Do you think it would be possible to add a feature that would write to a file based on the ip:port information it receives in the header?

Enable nanosecond resolution

Setup Conan packet manager