google / google/gopacket

Gopacket capture losing data

Open
#789 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
6.8k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

I was implementing an application using [pcap.OpenLive](https://godoc.org/github.com/google/gopacket/pcap#OpenLive) to capture the data directly from an interface and [tcpassembly](https://godoc.org/github.com/google/gopacket/tcpassembly) to reassembly HTTP streams. The streams that I was trying to assemble are GET requests to files with a size of 2,2 MB. When I try to run the program capturing data from a network interface, the program hangs in the reading of the request body. When I captured the network data with wireshark and run my program reading the packets from the pcap the program runs without problems.

After trying several things to fix this problem, I found this closed issue #237.

I adjusted the [script](https://gist.github.com/MrSuicideParrot/7350dce01afb9c3ffbcda0eb4feb647e) from the issue mentioned above and then sent a [file](https://archive.openwrt.org/chaos_calmer/15.05/x86/64/openwrt-15.05-x86-64-rootfs-squashfs.img) twice using netcat, one with gopacket sniffing the network and the other with wireshark. From the pcap generated by wireshark I was able to extract a correct copy of the file but with the gopacket's pcap I was not. Thus, I was able to reproduce the error mentioned in this issue.

Is this a bug or a known limitation (#329)?

### Temporary solution
I solved this problem using [AF_PACKET](https://godoc.org/github.com/google/gopacket/afpacket) to capture the network data. With this, I was able to reassemble HTTP sessions with my program and successfully extract a file sent with netcat from a gopacket's pcap.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.