search

aboutsip / pkts

Pure java based pcap library capable of reading and writing to/from pcaps.
Other
198 stars 92 forks source link

IllegalArgumentException: Unknown header type #85

Closed enp closed 6 years ago

enp commented 6 years ago

Hi,

I tried to read pcap file by this code:

#!/usr/bin/env groovy

@Grab('io.pkts:pkts-core:3.+')

import io.pkts.Pcap

Pcap pcap = Pcap.openStream('/tmp/icmp.pcap')

and got error:

Caught: java.lang.IllegalArgumentException: Unknown header type
java.lang.IllegalArgumentException: Unknown header type
        at io.pkts.frame.PcapGlobalHeader.parse(PcapGlobalHeader.java:207)
        at io.pkts.Pcap.openStream(Pcap.java:123)
        at io.pkts.Pcap.openStream(Pcap.java:152)
        at io.pkts.Pcap.openStream(Pcap.java:163)
        at io.pkts.Pcap$openStream.call(Unknown Source)
        at icmp.run(icmp.groovy:7)

File is valid:

$ tshark -r /tmp/icmp.pcap 
    1   0.000000    127.0.0.1 → 127.0.0.1    ICMP 98 Echo (ping) request  id=0x55be, seq=1/256, ttl=64
    2   0.000013    127.0.0.1 → 127.0.0.1    ICMP 98 Echo (ping) reply    id=0x55be, seq=1/256, ttl=64 (request in 1)

So, why I can't read it?

jonbo372 commented 6 years ago

Hi,

Thanks for reporting. Could you send me the pcap you used? Send it to jonas@jonasborjesson.com

igaoliang commented 6 years ago

emmmm. the same problem .

Exception in thread "main" java.lang.IllegalArgumentException: Unknown header type at io.pkts.frame.PcapGlobalHeader.parse(PcapGlobalHeader.java:207) at io.pkts.Pcap.openStream(Pcap.java:123) at io.pkts.Pcap.openStream(Pcap.java:152) at io.pkts.Pcap.openStream(Pcap.java:163) at PcapTestKt.analysisPcap(PcapTest.kt:17) at PcapTestKt.main(PcapTest.kt:12)

aboutsip commented 6 years ago

Please send me a pcap that doesn't work so I can take a look at it. Certainly seems like you are using a newer format that I myself has, so far, no need for and as such there is no support for it. Also make sure that you didn't specify compression since I don't support that right now.

Pull requests are welcome!

igaoliang commented 6 years ago

ok. my test case and the pcap file is here.

http://note.youdao.com/noteshare?id=0a0f2dc01798d82a49e74e8b2afc84ce

aboutsip commented 6 years ago

Hi,

So the file you sent me is indeed in the next generation pcap (pcap-ng) format, which pkts.io do not support at this moment. Please ensure to save in the old pcap format. Issue 86 is tracking this so I'm closing this as a duplicate of that one.

igaoliang commented 6 years ago

thanks.

lavanyasundararajan commented 5 years ago

I also face the same issue Unknown header type I have sent the .pcap file to jonas@jonasborjesson.com That file a wireless capture it is in encrypted format. Will that be a problem