thinrope
commented
11 years ago Here is a patch-o-hack to HEAD that works for me (cannot attach it here, so inline):
From 68ed1623c29ac480566d2de493539af118f29cad Mon Sep 17 00:00:00 2001
From: Kalin KOZHUHAROV <me.kalin@gmail.com>
Date: Wed, 10 Jul 2013 19:15:33 +0900
Subject: [PATCH] Trying to fix issue 1
https://github.com/Rup0rt/pcapfix/issues/1 It is really a
hack, better to have an option not to mug around with
timestamps.
---
pcapfix.c | 71 ++----------------------------------------------------------
1 files changed, 3 insertions(+), 68 deletions(-)
diff --git a/pcapfix.c b/pcapfix.c
index 562e840..3b154f4 100644
--- a/pcapfix.c
+++ b/pcapfix.c
@@ -124,15 +124,6 @@ int is_plausible(struct packet_hdr_s hdr, unsigned int prior_ts) {
// the included length CAN NOT be larger than the original length
if (conint(hdr.incl_len) > conint(hdr.orig_len)) return(5);
- // packet is not older than one day (related to prior packet)
- if ((prior_ts != 0) && (conint(hdr.ts_sec) > (prior_ts+86400))) return(6);
-
- // packet is not younger than one day (related to prior packet)
- if ((prior_ts >= 86400) && (conint(hdr.ts_sec) < (prior_ts-86400))) return(7);
-
- // usec (microseconds) must be > 0 AND <= 1000000
- if (conint(hdr.ts_usec) < 0) return(8);
- if (conint(hdr.ts_usec) > 1000000) return(9);
// all conditions fullfilled ==> everything fine!
return(0);
@@ -220,8 +211,6 @@ int main(int argc, char *argv[]) {
unsigned long nextpos = 0; // possible position of next packets header
unsigned long filesize; // file size
unsigned int count; // packet counter
- unsigned int last_correct_ts_sec = 0; // timestamp of the last proper packet found (seconds)
- unsigned int last_correct_ts_usec = 0; // timestamp of the last proper packet found (microseconds)
unsigned short hdr_integ; // integrity counter of global header
unsigned long bytes; // read/written bytes counter (unused yet)
int c; // loop counter
@@ -461,7 +450,7 @@ int main(int argc, char *argv[]) {
bytes = fread(hdrbuffer, sizeof(hdrbuffer), 1, pcap);
// check if the packet header looks proper
- res = check_header(hdrbuffer, sizeof(hdrbuffer), last_correct_ts_sec, &packet_hdr);
+ res = check_header(hdrbuffer, sizeof(hdrbuffer), 0, &packet_hdr);
if (res != -1) {
// realign packet body (based on possible-ascii corrupted pcap header)
@@ -508,7 +497,7 @@ int main(int argc, char *argv[]) {
if (verbose >= 2) printf("[*] Trying Packet #%u at position %ld (%u | %u | %u | %u).\n", (count+1), nextpos, conint(next_packet_hdr.ts_sec), conint(next_packet_hdr.ts_usec), conint(next_packet_hdr.incl_len), conint(next_packet_hdr.orig_len));
// check the header for plausibility
- res = check_header(hdrbuffer, sizeof(hdrbuffer), last_correct_ts_sec, &next_packet_hdr);
+ res = check_header(hdrbuffer, sizeof(hdrbuffer), 0, &next_packet_hdr);
if (res != -1) {
// we found a proper header inside the packets body!
@@ -518,23 +507,6 @@ int main(int argc, char *argv[]) {
packet_hdr.incl_len = conint(nextpos-(pos+16)+res); // also include ascii corruption offset (res)
packet_hdr.orig_len = packet_hdr.incl_len;
- // time correction for the FIRST packet only
- if (count == 1) {
- if (conint(next_packet_hdr.ts_usec) > 0) {
- // next packets usec is > 0 ===> first packet will get same timestamp and usec - 1
- packet_hdr.ts_sec = next_packet_hdr.ts_sec;
- packet_hdr.ts_usec = conint(conint(next_packet_hdr.ts_usec)-1);
- } else if(conint(next_packet_hdr.ts_sec) > 0) {
- // else: next packets timestamp i > 0 ===> firt packet will get timestamp -1 and maximum usec
- packet_hdr.ts_sec = conint(conint(next_packet_hdr.ts_sec)-1);
- packet_hdr.ts_usec = conint(999999);
- } else {
- // else: (next packets sec and usec are zero), this packet will get zero times as well
- packet_hdr.ts_sec = conint(0);
- packet_hdr.ts_usec = conint(0);
- }
- }
-
// print out information
printf("[+] CORRECTED Packet #%u at position %ld (%u | %u | %u | %u).\n", count, pos, conint(packet_hdr.ts_sec), conint(packet_hdr.ts_usec), conint(packet_hdr.incl_len), conint(packet_hdr.orig_len));
corrupted++;
@@ -557,9 +529,6 @@ int main(int argc, char *argv[]) {
bytes = fwrite(&packet_hdr, sizeof(packet_hdr), 1, pcap_fix); // write packet header to output file
bytes = fwrite(&buffer, conint(packet_hdr.incl_len), 1, pcap_fix); // write packet body to output file
- // remember that this packets timestamp to evaluate futher timestamps
- last_correct_ts_sec = conint(packet_hdr.ts_sec);
- last_correct_ts_usec = conint(packet_hdr.ts_usec);
} else {
@@ -590,15 +559,6 @@ int main(int argc, char *argv[]) {
packet_hdr.incl_len = conint(filesize-(pos+16));
packet_hdr.orig_len = packet_hdr.incl_len;
- // if the is the first packet, we need to set timestamps to zero
- if (count == 1) {
- packet_hdr.ts_sec = conint(0);
- packet_hdr.ts_usec = conint(0);
- } else { // else take the last correct timestamp and usec plus one
- packet_hdr.ts_sec = conint(last_correct_ts_sec);
- packet_hdr.ts_usec = conint(last_correct_ts_usec+1);
- }
-
// read the packets body (size based on the just found next packets position)
fseek(pcap, pos+16, SEEK_SET);
bytes = fread(&buffer, conint(packet_hdr.incl_len), 1, pcap);
@@ -607,9 +567,6 @@ int main(int argc, char *argv[]) {
bytes = fwrite(&packet_hdr, sizeof(packet_hdr), 1, pcap_fix); // write packet header to output file
bytes = fwrite(&buffer, conint(packet_hdr.incl_len), 1, pcap_fix); // write packet body to output file
- // remember that this packets timestamp to evaluate futher timestamps
- last_correct_ts_sec = packet_hdr.ts_sec;
- last_correct_ts_usec = packet_hdr.ts_usec;
// print out information
printf("[+] CORRECTED LAST Packet #%u at position %ld (%u | %u | %u | %u).\n", count, pos, conint(packet_hdr.ts_sec), conint(packet_hdr.ts_usec), conint(packet_hdr.incl_len), conint(packet_hdr.orig_len));
@@ -625,7 +582,7 @@ int main(int argc, char *argv[]) {
if (verbose >= 2) printf("[*] Trying Packet #%u at position %ld (%u | %u | %u | %u).\n", (count+1), nextpos, conint(next_packet_hdr.ts_sec), conint(next_packet_hdr.ts_usec), conint(next_packet_hdr.incl_len), conint(next_packet_hdr.orig_len));
// check if next packets header looks proper
- res = check_header(hdrbuffer, sizeof(hdrbuffer), last_correct_ts_sec, &next_packet_hdr);
+ res = check_header(hdrbuffer, sizeof(hdrbuffer), 0, &next_packet_hdr);
if (res != -1) {
// if we found a packet that is below the top 65535 bytes (deep scan) we cut it off and take the second packet as first one
@@ -647,25 +604,6 @@ int main(int argc, char *argv[]) {
packet_hdr.incl_len = conint(nextpos-(pos+16));
packet_hdr.orig_len = packet_hdr.incl_len;
- if (count == 1) { // time correction for the FIRST packet
- if (conint(next_packet_hdr.ts_usec) > 0) {
- // next packets usec is > 0 ===> first packet will get same timestamp and usec - 1
- packet_hdr.ts_sec = next_packet_hdr.ts_sec;
- packet_hdr.ts_usec = conint(conint(next_packet_hdr.ts_usec)-1);
- } else if(conint(next_packet_hdr.ts_sec) > 0) {
- // else: next packets timestamp i > 0 ===> firt packet will get timestamp -1 and maximum usec
- packet_hdr.ts_sec = conint(conint(next_packet_hdr.ts_sec)-1);
- packet_hdr.ts_usec = conint(999999);
- } else {
- // else: (next packets sec and usec are zero), this packet will get zero times as well
- packet_hdr.ts_sec = conint(0);
- packet_hdr.ts_usec = conint(0);
- }
- } else { // ALL packets except the first one will use the last correct packets timestamps
- packet_hdr.ts_sec = last_correct_ts_sec;
- packet_hdr.ts_usec = conint(last_correct_ts_usec+1);
- }
-
// read the packets body (size based on the just found next packets position)
fseek(pcap, pos+16, SEEK_SET);
bytes = fread(&buffer, packet_hdr.incl_len, 1, pcap);
@@ -674,9 +612,6 @@ int main(int argc, char *argv[]) {
bytes = fwrite(&packet_hdr, sizeof(packet_hdr), 1, pcap_fix); // write packet header to output file
bytes = fwrite(&buffer, conint(packet_hdr.incl_len), 1, pcap_fix); // write packet body to output file
- // remember that this packets timestamp to evaluate futher timestamps
- last_correct_ts_sec = packet_hdr.ts_sec;
- last_correct_ts_usec = packet_hdr.ts_usec;
// print out information
printf("[+] CORRECTED Packet #%u at position %ld (%u | %u | %u | %u).\n", count, pos, conint(packet_hdr.ts_sec), conint(packet_hdr.ts_usec), conint(packet_hdr.incl_len), conint(packet_hdr.orig_len));
--
1.7.8.6
Rup0rt
Hello,
I recently hit a borked pcap file from a client, one bad file in the middle of 500GB capture series, so I tried pcapfix-0.7, but got a lot of junk and all timestamps were reset to 1970-01-01. Looking at the code, I carved out all suspicious "fixes" and it worked. Then I realized I should try different versions and I found this repo. A quick git bisect found the offender to be commit 0a6304c79081c06634d7a78bb9534b0c1604e6e3 (0.6). Basically version 0.5 works fine:
while 0.6 does NOT:
To sum it up, I guess that 0.6 and above use wrong logic to back-correct timestamps. Running with -v:
Unfortunately I cannot share the pcap file, but I am willing to test any patch.