search

KimiNewt / pyshark

Python wrapper for tshark, allowing python packet parsing using wireshark dissectors
MIT License
2.23k stars 422 forks source link

FileCapture lost the first packet when parsing pcap file if only_summaries is True #148

Closed dog-2 closed 2 years ago

dog-2 commented 8 years ago

I've captured some dns packets through wireshark and saved as pcap, and i want to parse it with pyshark.FileCapture。

And i need to set _onlysummaries to both False and True to get both packet details and summary info. When set to False, it works well, however when True got some bugs, the first packet was lost.

This was test on both osx and ubuntu and got the same result.

I've debugged into the source code and got a solution, however i didn't get clear about why the buffer reading and PSML parsing goes wrong:

Just delete or comment the source code in line 177 of pyshark/capture/capture.py, which in _packets_from_tshark_sync() function and the code is:

data = b''

what's more, i've got another issue, which have been discussed in #88 but cannot work well.

Qlzr commented 5 years ago

You can try to change the value of the variable SUMMARIES_BATCH_SIZE from 64 to 8 in line 42 of pyshark/capture/capture.py

fkerem commented 3 years ago

SUMMARIES_BATCH_SIZE = 4 (and 8) didn't work for me on MacOS. SUMMARIES_BATCH_SIZE = 5 seems to work for now.

fkerem commented 1 year ago

SUMMARIES_BATCH_SIZE = 4 (and 8) didn't work for me on MacOS. SUMMARIES_BATCH_SIZE = 5 seems to work for now.

This configuration is not valid for the newest version, that's why I use version 0.4.3.