search

cisco / joy

A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.
Other
1.31k stars 329 forks source link

retrieving MAC Address #270

Open cschulze7 opened 5 years ago

cschulze7 commented 5 years ago

No eth=1 option? It occurred to me to extract the MAC addresses for each flow. However, I dont see a way to do that. But in joy.c there is the get_mac_address function. How can I get the ethernet layer info for each flow with the MAC addresses (src and dst) included?

bhudson33 commented 5 years ago

JOY starts processing at the IP layer. The MAC address function is used for displaying the interfaces for a live capture. If you want the Ethernet later information, you would have to modify the function process_packet in module pkt_proc.c. You will see in that function where the Ethernet header is skipped over.

Cheers, Bill.

Sent from my iPhone

On Jun 12, 2019, at 6:10 AM, cschulze7 notifications@github.com<mailto:notifications@github.com> wrote:

No eth=1 option? It occurred to me to extract the MAC addresses for each flow. However, I dont see a way to do that. But in joy.c there is the get_mac_address function. How can I get the ethernet layer info for each flow with the MAC addresses (src and dst) included?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHubhttps://github.com/cisco/joy/issues/270?email_source=notifications&email_token=AECMFHDWBXYFBMWKBGSNZGTP2DYT3A5CNFSM4HXIZ7YKYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4GZB4AUA, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AECMFHBOVWB33TT5B623NBDP2DYT3ANCNFSM4HXIZ7YA.

ctwardy commented 2 years ago

I have a draft solution here: https://github.com/Sotera/joy/tree/mac_addr.

Notes on this ticket. Could use review from C programmers.