search

Rup0rt / pcapfix

repair corrupted pcap files
http://f00l.de/pcapfix/
GNU General Public License v3.0
202 stars 34 forks source link

Read compressed files #17

Closed alexmarder closed 3 years ago

alexmarder commented 4 years ago

It would be great to have the ability to fix compressed pcaps (such as with gzip or bzip2), or have some way to pipe uncompressed output to pcapfix.

Rup0rt commented 3 years ago

I though about it and think that this might not work since pcapfix is designed to handle very large files that 1) are hard to pipe and 2) might not fit into memory (pcapfix seeks in files to look for proper packets, which is not possible on pipes)

So I assume best solution would be to use a small bash script that decompresses, fixes and compresses again.

alexmarder commented 3 years ago

Thanks for the reply. My thought with pipes is that you could buffer the input (depending on how far back you might seek). If you know the maximum possible backward seek in bytes, you could buffer the pipe with at least that many bytes.

Rup0rt commented 3 years ago

Yes, you are right. I had an early version of pcapfix that worked this way. The problem was, that it took ages to repair a 150GB file. I dont really know how to fulfill both needs in a good way and - in best case - without completly rework the design of the tool :P