Open dougburks opened 7 years ago
There is also an issue with pulling pcap/transcript for alerts that come in at 0000. The $start_file error will also occur in a scenario where the back occurs in the previous day. I haven't had a chance to mock up anything to address the previous day issue but would be curious what you have in mind for this @dougburks or @bammv
I uploaded an update to pcap_agent.tcl to day. Please let me know if it corrected the issues.
Hi Bamm,
I'm experimenting with your latest code from github and am especially excited about being able to get transcripts for TCP streams that span multiple pcap files (https://github.com/bammv/sguil/commit/23e40a807b46bd54a24e3a7636a7a348d7a69deb)!
However, if I take a fresh database and immediately generate some alerts and then pivot to transcript, I get an error like this:![screen shot 2016-10-21 at 10 54 08 am](https://cloud.githubusercontent.com/assets/1659467/19602840/c7bd6154-977c-11e6-9059-c5e96b9bb009.png)
If I'm reading the code correctly:
I think this is somewhat of a corner case and should really only happen within the first 2 minutes of starting Sguil. I suppose I could shorten $BACK_SECONDS to something smaller like 60 to decrease the likelihood of a user running into this. But I'm wondering if it might be better to add some code here: https://github.com/bammv/sguil/blob/master/sensor/pcap_agent.tcl#L349
to check and see if $start_file is null and, if so, set it to the earliest pcap available.
Any thoughts?
Thanks!