[DRILL-6179] Added pcapng-format support - ASF JIRA

Attach files

Attach Screenshot

Voters

Watch issue

Watchers

Create sub-task

Link

Clone

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: New Feature
Status: Resolved
Priority: Major
Resolution: Fixed
Affects Version/s: 1.13.0
Fix Version/s: 1.15.0
Component/s: None
Labels:
- doc-complete
- ready-to-commit

Description

The PCAP Next Generation Dump File Format (or pcapng for short) [1] is an attempt to overcome the limitations of the currently widely used (but limited) libpcap format.

At a first level, it is desirable to query and filter by source and destination IP and port, and src/dest mac addreses or by protocol. Beyond that, however, it would be very useful to be able to group packets by TCP session and eventually to look at packet contents.

Initial work is available at https://github.com/mapr-demos/drill/tree/pcapng_dev

[1] https://pcapng.github.io/pcapng/