Skip to content

Log the type of parsed network traffic #105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 22, 2025
Merged

Log the type of parsed network traffic #105

merged 1 commit into from
Apr 22, 2025

Conversation

cesher
Copy link
Contributor

@cesher cesher commented Apr 22, 2025

Latest experiment indicates that pcap is not the issue, packets are getting non-zero timestamps. The question then becomes: How is it possible to observed parsed network traffic where both the first packet and last packet timestamps are zero if we can definitely see that pcap timestamped each packet correctly?

I think this indicates that the zero timestamp issue must be coming from within the the assembler or within the stream.go file. The following change will confirm which of the two.

Either:

  • The assembler does indeed manipulate the timestamps, somehow setting them to zero.
  • The parsed network traffic we observe with zero timestamps is actually DroppedBytes.

@cesher cesher requested a review from mgritter as a code owner April 22, 2025 17:46
@cesher cesher merged commit 6151571 into main Apr 22, 2025
4 checks passed
@cesher cesher deleted the POA-3321-exp-3 branch April 22, 2025 17:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants