node-pcap
Showing stats for an offline PCAP session
Hi All, Does the pcap stats function - pcap_session.stats work for an offline session? I get the following error when using it. Ideally I would like to count the packets in my pcap file, do some processing with pcap.decode.packet() then close the session with pcap_session.close().
.../node_modules/pcap/pcap.js:119
return this.session.stats();
^
Error: Error in pcap_stats
at PcapSession.stats (.../node_modules/pcap/pcap.js:119:25)
at Object.
Thanks in advance. Lance.
Hi Lance.
This is in fact not possible. The libpcap library do not support stats for files: https://www.tcpdump.org/manpages/pcap_stats.3pcap.html
Cheers, Thibaut
On Wed, May 20, 2020 at 9:25 AM lance23au [email protected] wrote:
Hi All, Does the pcap stats function - pcap_session.stats work for an offline session? I get the following error when using it. Ideally I would like to count the packets in my pcap file, do some processing with pcap.decode.packet() then close the session with pcap_session.close().
.../node_modules/pcap/pcap.js:119 return this.session.stats(); ^ Error: Error in pcap_stats at PcapSession.stats (.../node_modules/pcap/pcap.js:119:25) at Object. (.../routes/nodediscovery.js:58:26) at Module._compile (internal/modules/cjs/loader.js:1133:30) at Object.Module._extensions..js (internal/modules/cjs/loader.js:1153:10) at Module.load (internal/modules/cjs/loader.js:977:32) at Function.Module._load (internal/modules/cjs/loader.js:877:14) at Module.require (internal/modules/cjs/loader.js:1019:19) at require (internal/modules/cjs/helpers.js:77:18) at Object. (.../app.js:20:27) at Module._compile (internal/modules/cjs/loader.js:1133:30)
Thanks in advance. Lance.
— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/node-pcap/node_pcap/issues/264, or unsubscribe https://github.com/notifications/unsubscribe-auth/AD4KPWQW5DZ43O26P5BGWU3RSOAVRANCNFSM4NFVMQAQ .
Is there any other way to work out how many packets are in the pcap file?
Cheers, Lance.
Not simply. You have to parse the file entirely. You don't need to decode the packets, but go through it entirely, reading packetHeader one by one to get the size of the packet itself, to be able to go to next packet, and next one and so on.
You may use https://github.com/kunklejr/node-pcap-parser to do it, and then count how many packets events you got.
Cheers Thibaut
On Wed, May 20, 2020 at 11:24 AM lance23au [email protected] wrote:
Is there any other way to work out how many packets are in the pcap file?
Cheers, Lance.
— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/node-pcap/node_pcap/issues/264#issuecomment-631355811, or unsubscribe https://github.com/notifications/unsubscribe-auth/AD4KPWVL5ZXQFETBHRR37QLRSOOWNANCNFSM4NFVMQAQ .