box / box/memsniff

Error reading pcap file

Open
#12 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
144
Forks
16
PR merge metrics
No merged PRs in 30d

Description

Hi Box team,

I'm trying to use memsniff to parse traffic on my memcached server. Due to OS limitation I can't run memsniff directly on the server. Instead I'm looking into running memsniff somewhere else to read the captured pcap files.

however I ran into an error when reading the captured pcap file:
`Error from DecodeLayers: No decoder for layer type Unknown`

no result is showing in memsniff and the last message I received is `Reached EOF, waiting for workers to finish `

command used to capture traffic:
`tcpdump -nnA -i any "dst port 11211" -s 0 -X -w output.pcap`

command used for running memsniff:
`memsniff -r output.pcap`

`tcpdump` is executed on a CentOS5 server, and `memsniff` is built & executed from my laptop (MacOS). I'm using the latest version (as this is written) of `memsniff`:
```
memsniff --version
2019/02/05 11:12:47.783652 memsniff version 1.4.0 (revision autopopulated by build.sh)
```

can you help me figuring out what I did wrong in using memsniff? the same pcap file can be opened fine in `wireshark` so I figured it's probably the way I used memsniff that's causing this issue.

thanks in advance!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.