We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
When generating flowtuples from pcaps, corsarotrace does not follow the interval and rotatefreq options.
interval
rotatefreq
Commit: 9e899da
Steps to reproduce (using Podman, Docker should be similar):
from scapy.all import * from datetime import datetime, timedelta start_date = datetime.now() packets = [] for i in range(24): packet_time = start_date + timedelta(hours=i) packet = Ether() / IP(src="192.168.1.1", dst="192.168.1.2") / UDP(sport=12345, dport=80) / Raw(load=f"Packet from day {i+1}") packet.time = packet_time.timestamp() packets.append(packet) wrpcap("one_day.pcap", packets)
mkdir output podman run -v './output:/flowtuple/output:rw' -v './one_day.pcap:/flowtuple/example.pcap:ro' offlineft pcapfile:/flowtuple/example.pcap trial run ls output/*.avro | wc -l
Result: 1 Expected: 24 files since baseconfig.yaml contains interval: 60 and rotatefreq: 60 (one file per hour).
interval: 60
rotatefreq: 60
echo "threads: 1" >> baseconfig.yaml podman build -t offlineft . podman run -v './output:/flowtuple/output:rw' -v './one_day.pcap:/flowtuple/example.pcap:ro' offlineft pcapfile:/flowtuple/example.pcap trial run rm output/* ls output/*.avro | wc -l
Result: 24 (expected)
The text was updated successfully, but these errors were encountered:
No branches or pull requests
When generating flowtuples from pcaps, corsarotrace does not follow the
interval
androtatefreq
options.Commit: 9e899da
Steps to reproduce (using Podman, Docker should be similar):
Result: 1
Expected: 24 files since baseconfig.yaml contains
interval: 60
androtatefreq: 60
(one file per hour).Result: 24 (expected)
The text was updated successfully, but these errors were encountered: