search

david415 / HoneyBadger

Quantum Insert detector/recorder
GNU General Public License v3.0
305 stars 39 forks source link

pcap log rotation for connection log quota #62

Closed david415 closed 9 years ago

david415 commented 9 years ago

We do indeed need a way to enforce an on-disk quota of pcap logs per each connection tracked. A log rotation scheme can easily accomplish this goal.

david415 commented 9 years ago

work in progress:

here's a rough quota enforced Writer using a log rotation scheme: https://github.com/david415/HoneyBadger/commit/346babdae967a4e6aac81cae1b22d7aa915c624c

It just occurred to me that each new pcap file will need the appropriate pcap header written to the beginning...

david415 commented 9 years ago

so far i've made numerous bug fixes to the dev branch... and it seems to work now: https://github.com/david415/HoneyBadger/tree/62-rotating-pcap

david415 commented 9 years ago

reopening... due to reverting several bad commits... we are going to reapply these changes or make similar new ones.

david415 commented 9 years ago

fixed... finally!