aicers / giganto

Raw-Event Storage System for AICE
Apache License 2.0
6 stars 3 forks source link

Fail to send pcap extraction request to sensor #859

Closed syncpark closed 1 month ago

syncpark commented 1 month ago

src/publish.rs 코드에서 process_pcap_request 함수에 다음과 같은 디버깅 코드를 추가해서 확인한 내용입니다. https://github.com/aicers/giganto/blob/bb1fbf33251e23983bd9f4150c66836ec0897d3f/src/publish.rs#L309-L315

    tracing::debug!("pcap_sources: {:?}", pcap_sources);

Piglet이 죽었다가 다시 연결했을 경우 다음처럼 pcap_sources, sensor 목록이 비어있습니다. 이 때문에 sensor에게 pcap extraction request를 전송하지 못하는 문제가 있습니다.

2024-10-18T01:18:56.949030Z DEBUG pcap_sources: RwLock { data: {} }
2024-10-18T01:18:56.949421Z DEBUG Received pcap extract request: PcapFilter { timestamp: 1729214314217511202, source: "collect", src_addr: 193.35.18.234, src_port: 37618, dst_addr: 100.1.30.43, dst_port: 80, proto: 6, last_time: 1729214314217511205 }
2024-10-18T01:18:56.949452Z ERROR Neither current nor peer gigantos are in charge of requested pcap source collect
kimhanbeom commented 1 month ago

Issue detail

Task