Improve DHCP IP address parsing speed for journal

fox-it / dissect.target

The Dissect module tying all other Dissect modules together. It provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets).

GNU Affero General Public License v3.0

38 stars 42 forks source link

Improve DHCP IP address parsing speed for journal #687

Open JSCU-CNI opened 2 months ago

JSCU-CNI commented 2 months ago

This PR aims to improve DHCP parsing logic introduced in #550. Unfortunately the previous approach makes interactive commands such as target-info slow. We have opted to only parse the first 10000 journal log messages for DHCP IP address leases by default. This can be extended with the flag --dhcp-all.

JSCU-CNI commented 1 month ago

Hi @Horofic could you take a look at this PR? This fix makes sure target-info does not take up to two hours to complete :)