search

ahlashkari / CICFlowMeter

CICFlowmeter-V4.0 (formerly known as ISCXFlowMeter) is an Ethernet traffic Bi-flow generator and analyzer for anomaly detection that has been used in many Cybersecurity datsets such as Android Adware-General Malware dataset (CICAAGM2017), IPS/IDS dataset (CICIDS2017), Android Malware dataset (CICAndMal2017) and Distributed Denial of Service (CICDDoS2019).
Other
537 stars 269 forks source link

CICFLOWMETER GENERATING empty flow #140

Closed Jiarubab closed 1 year ago

Jiarubab commented 2 years ago

I want to generate flow from CICFLOWMETER by its showing all packets ignored. Here is a snapshot of my problem.

Capture

hasnaamohi commented 2 years ago

Did you solve this proplem ?

Jiarubab commented 2 years ago

No Sir.

From: hasnaamohi @.> Sent: Wednesday, June 1, 2022 4:04 AM To: ahlashkari/CICFlowMeter @.> Cc: Jiarubab @.>; Author @.> Subject: Re: [ahlashkari/CICFlowMeter] CICFLOWMETER GENERATING empty flow (Issue #140)

Did you solve this proplem ?

— Reply to this email directly, view it on GitHubhttps://github.com/ahlashkari/CICFlowMeter/issues/140#issuecomment-1143092896, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AYBR4UGBW7ZXHJF6HN366LLVM3ONHANCNFSM5UQJSAVQ. You are receiving this because you authored the thread.Message ID: @.***>

souravs17031999 commented 1 year ago

@hasnaamohi @Jiarubab was this solved, I am facing same.

hasnaamohi commented 1 year ago

No

في الجمعة، ٢٤ فبراير ٢٠٢٣, ٦:٤٢ م Sourav Kumar @.***> كتب:

@hasnaamohi https://github.com/hasnaamohi @Jiarubab https://github.com/Jiarubab was this solved, I am facing same.

— Reply to this email directly, view it on GitHub https://github.com/ahlashkari/CICFlowMeter/issues/140#issuecomment-1443987082, or unsubscribe https://github.com/notifications/unsubscribe-auth/AZMQCQ46RUX3HKUKAXCQ4W3WZDQHXANCNFSM5UQJSAVQ . You are receiving this because you were mentioned.Message ID: @.***>

hessammohammadian commented 1 year ago

The problem is not the CICFlowmeter. It's probably from your pcap file. If the pcap files don't have an actual ethernet layer the CICFlowmeter can't detect any flows. As you can see in your output all packets are ignored. You need to add the ethernet layer to all pcap files and then it will work. tcprewrite --dlt=enet --infile="" --outfile=""