search

fmadio / pcap2json

High Speed PCAP to JSON conversion utility
Other
97 stars 21 forks source link

TopN sorting with exact byte match. Second sort based on packet prope… #19

Closed nanji-fmad closed 5 years ago

nanji-fmad commented 5 years ago

Still "TCP.WindowMin/Max" are different and we can't disable threads in this case otherwise this issue itself won't happen. So, to verify this, I have used "jq"...which will parse JSON and gives value for fields we select.

For example: jq -c [.timestamp,.TotalPkt,.TotalByte,.MACSrc,.MACDst] json_file_name >

Output: [1559567701500,1090060,1497742440,"7c:e2:ca:bd:97:d9","00:0e:52:80:00:16"] [1559567701500,43765,38828721,"7c:e2:ca:bd:97:d9","00:0e:52:80:00:16"] [1559567701500,21042,30233021,"7c:e2:ca:bd:97:d9","00:0e:52:80:00:16"] ...

fmadio commented 5 years ago

Not sure why it needs the second sort here

https://github.com/fmadio/pcap2json/pull/19/commits/e6249f0c06b94366093615af59ec5eb880db08c1#diff-e78303a36c0c122dcbaaba1a51f27d92R1436

Updated the code with the 2nd sort on the LSB of the SHA1 hash + fixed the TCP Window Min non-deterministic behavior

https://github.com/fmadio/pcap2json/commit/4e2fbc64ed90162c574e4afad2a1210e25478419