slytechs-repos / jnetpcap-legacy

jNetPcap v1 (Maintenance Only)
https://www.jnetpcap.org
GNU Lesser General Public License v2.1
4 stars 0 forks source link

Recommended version / unstable packet handling #8

Open sischnei opened 1 year ago

sischnei commented 1 year ago

Hi - I'm having some difficulties migrating from Java 8 to Java 11 with jnetpcap. We have a test suite that I believe worked very reliable with Java 8, but going to Java 11 exhibits a lot of issues even in basic use-cases such as offline looping and counting how many packets were found:

    @Test
    public void test() {
        AtomicInteger counter = new AtomicInteger(0);
        PcapPacketHandler<String> packetHandler = new PcapPacketHandler<String>() {
            @Override
            public void nextPacket(final PcapPacket jPacket, final String o) {
                counter.incrementAndGet();
            }
        };
        StringBuilder errorBuffer = new StringBuilder();
        final Pcap pcap = Pcap.openOffline("dumpcap.pcap", errorBuffer);
        final int result = pcap.loop(5000, packetHandler, null);
        pcap.close();
        System.out.println("Result: " + result);
        System.out.println("Counted packets: " + counter.get());
        System.out.println(errorBuffer);
        assertEquals(1289, counter.get());
    }

The above code works sometimes, but sometimes it does not. Interestingly, if I put a loop around the entire test, if it works, it consistently keeps working for hundreds of iterations, if it is not working, it already fails during the first iteration. To me this indicates that something isn't loaded / setup properly initially. The test fails either because the counter is still 0, or (with later jnetpcap versions - see below) because the application just crashes with an output like the following:

cb_pcap_packet_dispatch() - obj=000000f17befc370, mid=000002da6d2527b0, pcap_packet=000002da6c3d2ee8, user=0000000000000000
cb_pcap_packet_dispatch() - DeleteLocalRef
cb_pcap_packet_dispatch() - ExceptionCheck
cb_pcap_packet_dispatch() - ENTER
cb_pcap_packet_dispatch() - Java_org_jnetpcap_packet_JScanner_scan
cb_pcap_packet_dispatch() - transferToNewBuffer
cb_pcap_packet_dispatch() - CallVoidMethod
cb_pcap_packet_dispatch() - obj=000000f17befc370, mid=000002da6d2527b0, pcap_packet=000002da6c3d2f00, user=0000000000000000
cb_pcap_packet_dispatch() - DeleteLocalRef
cb_pcap_packet_dispatch() - ExceptionCheck
cb_pcap_packet_dispatch() - ENTER
cb_pcap_packet_dispatch() - Java_org_jnetpcap_packet_JScanner_scan
cb_pcap_packet_dispatch() - transferToNewBuffer

Process finished with exit code -1073740940 (0xC0000374)

I'm currently trying with the following dependency on Windows 10 amd64:

 <dependency>
       <groupId>jnetpcap</groupId>
       <artifactId>jnetpcap</artifactId>
       <version>1.5.r1457-1i</version>
</dependency>

Previously in Java 8 we were using the following dependency. I tried upgrading to the newer versions because our tests were unstable with this version in Java 11. The packet count often was 0 instead of the expected number:

<dependency>
       <groupId>jnetpcap</groupId>
       <artifactId>jnetpcap</artifactId>
     <version>1.4.r1425-1e</version>
</dependency>

Update It seems the nextEx(...) API doesn't suffer from the same issues as the pcapLoop(...) API. E.g. using the old library version 1.4.r1425-1e I can successfully read all packets using the nextEx-API even with Java 11. I assume, that I can't use the nextEx API for live capturing / filtering though, correct?

Update2 nextEx(...) API indeed works fine and also works for live capturing / filtering. See a sample here: https://stackoverflow.com/a/76572647/606513