Skip to content

Parse info, source, destination, etc. when using ek mode #574

Open
@miaotony

Description

@miaotony

Is your feature request related to a problem? Please describe.
I would like to get both detailed decoding info (including raw packet) and summary info (like one row in wireshark GUI), however from what I have tried in JSON / PDML / PSML mode tshark cannot provide both info. (If I'm not mistaken...

After trying EK mode with parameters -P -V -x, I surprisingly find that it provides what I want.

图片

Describe the solution you'd like
When using EK mode, provide some interfaces/functions or a dict containing the other fields besides layers.

Describe alternatives you've considered
When parsing raw json_pkt, the code only pick layers for further parsing and the other fields are ignored.

图片

def packet_from_ek_packet(json_pkt):
if USE_UJSON:
pkt_dict = ujson.loads(json_pkt)
else:
pkt_dict = json.loads(json_pkt.decode('utf-8'))
# We use the frame dict here and not the object access because it's faster.
frame_dict = pkt_dict['layers'].pop('frame')
layers = []
for layer in frame_dict['frame_frame_protocols'].split(':'):
layer_dict = pkt_dict['layers'].pop(layer, None)
if layer_dict is not None:
layers.append(EkLayer(layer, layer_dict))
# Add all leftovers
for name, layer in pkt_dict['layers'].items():
layers.append(EkLayer(name, layer))
return Packet(layers=layers, frame_info=EkLayer('frame', frame_dict),
number=int(frame_dict.get('frame_frame_number', 0)),
length=int(frame_dict['frame_frame_len']),
sniff_time=frame_dict['frame_frame_time_epoch'],
interface_captured=frame_dict.get('rame_frame_interface_id'))

Maybe you can add a dict in Packet class and set its default value to None to include the other fields meanwhile keeping compatibility.

BTW, you have to pay attention to pass -P -V parameters to tshark, just like LiveRingCapture in #573 .

Thank you very much!

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions