ruedigergad / cljnetpcap Goto Github PK

It should be possible to dump "raw" data to a file.
The format shall be the standard pcap format.

Currently native libs are not deleted when an existing directory is found.
This can be problematic in certain situations.
As a workaround always delete existing libraries when extracting the native libs on start-up.
Keeping the old libs won't save significant time on start-up anyhow.

Symptom is analogous to #7.
Sample output below:
{"sniffer.header.parsed" {"PcapHeader" {"timestampInNanos" 1345332080195344000, "wirelen" 631},
"DataLinkLayer"
{"index" 0,
"destination" "00:04:0E:3D:B0:86",
"source" "74:DE:2B:08:78:09",
"next" 2},
"NetworkLayer"
{"index" 1,
"destination" "62.146.26.38",
"source" "192.168.0.198",
"id" 39936,
"tos" 0,
"ttl" 64,
"next" 4},
"Tcp"
{"index" 2,
"destination" 80,
"source" 58118,
"ack" 87556976,
"seq" 2360073644,
"flags" #{"PSH" "ACK"},
"next" 13},
"Http"
{"index" 3,
"RequestUrl"
"Referer"
"RequestMethod" "GET",
"RequestVersion" "HTTP/1.1"}}}

Analogously to #9 it should be possible to read in a file that had been stored in pcap format.
The read data shall be passed directly to the forwarder fn.

Yet another method for querying statistical data (see #2 and #3) could be to output statistical data on request when a defined signal is received.

Currently, it is not possible to get statistical data from jNetPcap.
First step would be to print out statistical data when the example stand-alone application exits.

Sample output showing the issue:
{"PcapHeader" {"timestampInNanos" 1345332080314336000, "wirelen" 574},
"DataLinkLayer"
{"index" 0,
"destination" "00:04:0E:3D:B0:86",
"source" "74:DE:2B:08:78:09",
"next" 2},
"NetworkLayer"
{"index" 1,
"destination" "62.146.26.38",
"source" "192.168.0.198",
"id" 39943,
"tos" 0,
"ttl" 64,
"next" 4},
"Tcp"
{"index" 2,
"destination" 80,
"source" 58118,
"ack" 87565262,
"seq" 2360074209,
"flags" #{"PSH" "ACK"},
"next" 13},
"Http"
{"index" 3,
"RequestUrl" "/css/top.b64-DtuWNk.css",
"Referer"
"RequestMethod" "GET",
"RequestVersion" "HTTP/1.1"}}

In this case "Referer" should map to an empty string.

Related to #5 it would be a good idea to add some simple examples on how to use cljNetPcap.

As another alternative/enhancement to #2 it should be possible to output statistial data in regula intervals.
In order to not interfer with other output one option could be to write this to stderr.

Currently the documentation is pretty rudimentary. This should be improved.