[DRILL-6179] Added pcapng-format support

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.13.0
• Fix Version/s: 1.15.0
• Labels: doc-complete ready-to-commit
• Assignee: Vlad
• Reporter: Vlad
• Reviewer: Paul Rogers
• Created: 22/Feb/18 14:34
• Updated: 01/Feb/21 16:46
• Resolved: 21/Aug/18 17:09

Description

The PCAP Next Generation Dump File Format (or pcapng for short) [1] is an attempt to overcome the limitations of the currently widely used (but limited) libpcap format.

At a first level, it is desirable to query and filter by source and destination IP and port, and src/dest mac addreses or by protocol. Beyond that, however, it would be very useful to be able to group packets by TCP session and eventually to look at packet contents.

Initial work is available at  https://github.com/mapr-demos/drill/tree/pcapng_dev

[1] https://pcapng.github.io/pcapng/

 

Issue Links

• relates to: DRILL-7852 Handle PCAP/PCAPNG Better
• links to: GitHub Pull Request #1126
• links to: GitHub Pull Request #1126