Network Comparator Research

[ameily]

As part of #10, we need to do some initial work to determine what is feasible and what existing tools we can use to:

1. Monitor a process's network traffic and store it to a pcap file on disk.
2. Filter a pcap to only a specific process, executable, port, or flow that matches a query.
3. Compare 2 pcap files, ignoring expected randomness such as client ports, timestamps, etc. We could either compare the pcaps themselves or output flow data that we compare against
4. Query a pcap looking for specific flows or data

The output of this task is some discussion on this issue regarding what is a available and proposed solutions. Once we find an ideal approach, create follow-on issues under the epic to work on next.

[ameily]

I spent some time researching this today and I'm going to deprioritize this for the time being and go in a different direction instead for several reasons:

• Comparing two pcaps or providing some type of pattern matching for pcaps would be an extremely large amount of work because the variability of protocols, links, latency, etc. It can be done, but for our initial version I don't think it'll be necessary because there are other artifacts available to us.
  • And, what we are comparing? Flows, data, what level in the TCP/UDP stack?
• Evaluating a network server will require a client. In this case, the client knows whether the server is operating correctly and will produce some artifact indicating the result of the interaction with the server (stdout/stderr, output file, exit code, etc.)
  • Why would we replicate the checks that the client most likely already has within DIFFER? Just use the client

So, instead of creating a new framework for capturing network traffic and analyzing or comparing the results, I think the best solution is to add a new feature in DIFFER to compare both the server binary and the client, using the same extensible comparator component.

[ameily]

The initial version of this has been completed using the pcap file comparator. The functionality of the packet capture and comparison is somewhat basic for the time being:

1. capture traffic on a single network interface
2. compare only tcp or udp flows