secdev / secdev/scapy

Add way to specify snapshot length and buffer size when using pcap

Open
#4,680 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Python
Stars
12.6k
Forks
2.2k
Avg merge
1d 4h
Merged PRs (30d)
56

Description

When using pcap and a ring buffer for receiving packets, it can be useful to specify the snapshot length and the buffer size when receiving packets. For example, if you know that you'll only want to be processing small packets, then it could be worth setting the snapshot length to be a small value. This has a benefit on systems where libpcap uses TPACKET_V2, where the number of packets that can fit in the ring buffer depends on the size of the ring buffer and the snapshot length; smaller snapshot lengths means more packets can fit there.

Similarly, if you know you might want to handle large packets, then having an option to increase the buffer size could be beneficial.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Locate the pcap receive path and its ring-buffer setup, then read how libpcap and TPACKET_V2 currently determine snapshot length and buffer size. Define where these two settings should be exposed and verify that configured values affect packet capture without breaking existing defaults.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
networking
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.