Bug #57453 for Net-Pcap-Reassemble: Net-Pcap-Reassemble can't handle Linux cooked capture

Thu May 13 04:35:32 2010 pabs3 [...] bonedaddy.net - Ticket created

Subject:	Net-Pcap-Reassemble can't handle Linux cooked capture
Date:	Thu, 13 May 2010 16:35:12 +0800
To:	bug-Net-Pcap-Reassemble [...] rt.cpan.org
From:	Paul Wise <pabs3 [...] bonedaddy.net>

When using sniff2sipp, an app to convert pcap files to traces for the SIPp tool used to test SIP servers, I got this warning: Undefined subroutine &Net::Pcap::Reassemble::croak called at /usr/share/perl5/Net/Pcap/Reassemble.pm line 108. This is due to the file being a Linux cooked capture: $ file sip.pcap sip.pcap: tcpdump capture file (little-endian) - version 2.4 (Linux "cooked", capture length 65535) $ file samples/call.cap samples/call.cap: tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 65535) My packet capture scenario seems to create this format, it would be nice if Net::Pcap::Reassemble could handle it so that sniff2sipp would work. -- bye, pabs http://bonedaddy.net/pabs3/

Download signature.asc
application/pgp-signature 198b

Message body not shown because it is not plain text.

Thu May 13 05:45:25 2010 james [...] now.ie - Correspondence added

Subject:	Re: [rt.cpan.org #57453] Net-Pcap-Reassemble can't handle Linux cooked capture
Date:	Thu, 13 May 2010 10:44:56 +0100
To:	"pabs3 [...] bonedaddy.net via RT" <bug-Net-Pcap-Reassemble [...] rt.cpan.org>
From:	James Raftery <james [...] now.ie>

Hi, On Thu, May 13, 2010 at 04:35:33AM -0400, pabs3@bonedaddy.net via RT wrote: Show quoted text

> Undefined subroutine &Net::Pcap::Reassemble::croak called > at /usr/share/perl5/Net/Pcap/Reassemble.pm line 108.

The `Undefined ... croak()' is a cosmetic bug that's fixed in CVS and will be in the next release. Show quoted text

> This is due to the file being a Linux cooked capture: > My packet capture scenario seems to create this format, it would be nice > if Net::Pcap::Reassemble could handle it so that sniff2sipp would work.

I can have a look. Can you send me a capture file in that format please (to james@now.ie) ? Thanks for the bug report! james -- Times flies like an arrow. Fruit flies like bananas.

Thu May 13 05:45:29 2010 The RT System itself - Status changed from 'new' to 'open'

Thu May 13 14:34:25 2010 james [...] now.ie - Correspondence added

Subject:	Re: [rt.cpan.org #57453] Net-Pcap-Reassemble can't handle Linux cooked capture
Date:	Thu, 13 May 2010 19:34:11 +0100
To:	"pabs3 [...] bonedaddy.net via RT" <bug-Net-Pcap-Reassemble [...] rt.cpan.org>
From:	James Raftery <james [...] now.ie>

Hi, On Thu, May 13, 2010 at 04:35:33AM -0400, pabs3@bonedaddy.net via RT wrote: Show quoted text

> My packet capture scenario seems to create this format, it would be nice > if Net::Pcap::Reassemble could handle it so that sniff2sipp would work.

I managed to get a `cooked' capture myself. Would you mind trying an RC for a 0.05 release which fixes the croak() bug and adds cooked capture support? Please let me know if it solves your problem. It's at: http://romana.now.ie/software/Net-Pcap-Reassemble-0.05-RC.tar.gz FYI, the full list of changes from 0.04 is: 0.05 Fix bug when reading padded ethernet frames. Fix bug with missing Carp module. Support DLT_LINUX_SLL linktypes for `cooked' Linux captures. Some code cleanups and POD additions. Thanks, james

Thu May 13 14:35:02 2010 james [...] now.ie - Status changed from 'open' to 'patched'

Thu May 13 14:35:03 2010 james [...] now.ie - Severity Wishlist added

Thu May 13 14:35:34 2010 james [...] now.ie - Taken

Thu May 13 22:51:45 2010 pabs3 [...] bonedaddy.net - Correspondence added

Subject:	Re: [rt.cpan.org #57453] Net-Pcap-Reassemble can't handle Linux cooked capture
Date:	Fri, 14 May 2010 10:51:29 +0800
To:	bug-Net-Pcap-Reassemble [...] rt.cpan.org
From:	Paul Wise <pabs3 [...] bonedaddy.net>

On Thu, 2010-05-13 at 14:34 -0400, James Raftery via RT wrote: Show quoted text

> I managed to get a `cooked' capture myself. Would you mind trying an > RC for a 0.05 release which fixes the croak() bug and adds cooked > capture support? Please let me know if it solves your problem. > It's at: > > http://romana.now.ie/software/Net-Pcap-Reassemble-0.05-RC.tar.gz

That seems to resolve the croak bug for me, thanks. Unfortunately it doesn't make sniff2sipp work for me. Looks like the code do BTW, I note that Net::Pcap::Reassemble isn't available in Debian. Have you considered merging it into Net::Pcap (already in Debian)? Also, the Debian Perl team could probably use more members if you're interested in Debian or Ubuntu. -- bye, pabs http://bonedaddy.net/pabs3/

Download signature.asc
application/pgp-signature 198b

Message body not shown because it is not plain text.

Thu May 13 22:51:46 2010 The RT System itself - Status changed from 'patched' to 'open'

Thu May 13 22:54:00 2010 pabs3 [...] bonedaddy.net - Correspondence added

Subject:	Re: [rt.cpan.org #57453] Net-Pcap-Reassemble can't handle Linux cooked capture
Date:	Fri, 14 May 2010 10:53:47 +0800
To:	bug-Net-Pcap-Reassemble [...] rt.cpan.org
From:	Paul Wise <pabs3 [...] bonedaddy.net>

On Fri, 2010-05-14 at 10:51 +0800, Paul Wise wrote: Show quoted text

> Unfortunately it doesn't make sniff2sipp work for me. Looks like the > code do

...is not equipped to handle this type of capture. So I'll need to get tshark to just record Ethernet capture. Thanks for responding so quickly, hope I didn't waste too much of your time. -- bye, pabs http://bonedaddy.net/pabs3/

Download signature.asc
application/pgp-signature 198b

Message body not shown because it is not plain text.

Fri May 14 06:22:13 2010 james [...] now.ie - Correspondence added

Subject:	Re: [rt.cpan.org #57453] Net-Pcap-Reassemble can't handle Linux cooked capture
Date:	Fri, 14 May 2010 11:22:00 +0100
To:	"pabs3 [...] bonedaddy.net via RT" <bug-Net-Pcap-Reassemble [...] rt.cpan.org>
From:	James Raftery <james [...] now.ie>

Hi, On Thu, May 13, 2010 at 10:51:46PM -0400, pabs3@bonedaddy.net via RT wrote: Show quoted text

> That seems to resolve the croak bug for me, thanks.

Great. Show quoted text

> BTW, I note that Net::Pcap::Reassemble isn't available in Debian. Have > you considered merging it into Net::Pcap (already in Debian)? Also, the > Debian Perl team could probably use more members if you're interested in > Debian or Ubuntu.

I wouldn't have time. I'm not a regular Deb/Ubu user. The module is on CPAN so it's a one-liner install with the CPAN.pm module. On Thu, May 13, 2010 at 10:54:01PM -0400, pabs3@bonedaddy.net via RT wrote: Show quoted text

> > Unfortunately it doesn't make sniff2sipp work for me. Looks like the > > code do

> ...is not equipped to handle this type of capture. So I'll need to get > tshark to just record Ethernet capture. > > Thanks for responding so quickly, hope I didn't waste too much of your > time.

Yeah, looks like it only deals with ethernet. Change line 94 from my $ether_data = NetPacket::Ethernet::strip($packet); to my $ether_data = unpack("x16 a*"); might do it for you. The SLL header is 16 bytes so discarding them should let the IP and TCP/UDP decoders do their thing. james -- Times flies like an arrow. Fruit flies like bananas.

Fri May 14 07:30:03 2010 james [...] now.ie - Status changed from 'open' to 'patched'

Sat May 15 01:33:50 2010 pabs3 [...] bonedaddy.net - Correspondence added

Subject:	Re: [rt.cpan.org #57453] Net-Pcap-Reassemble can't handle Linux cooked capture
Date:	Sat, 15 May 2010 13:18:56 +0800
To:	bug-Net-Pcap-Reassemble [...] rt.cpan.org
From:	Paul Wise <pabs3 [...] bonedaddy.net>

On Fri, 2010-05-14 at 06:22 -0400, James Raftery via RT wrote: Show quoted text

> I wouldn't have time. I'm not a regular Deb/Ubu user. The module is on > CPAN so it's a one-liner install with the CPAN.pm module.

Fair enough. Show quoted text

> Yeah, looks like it only deals with ethernet. > > Change line 94 from > to > might do it for you. The SLL header is 16 bytes so discarding them > should let the IP and TCP/UDP decoders do their thing.

Thanks for the tip. -- bye, pabs http://bonedaddy.net/pabs3/

Download signature.asc
application/pgp-signature 198b

Message body not shown because it is not plain text.

Sat May 15 01:33:52 2010 The RT System itself - Status changed from 'patched' to 'open'

Sat May 15 09:00:11 2010 james [...] now.ie - Status changed from 'open' to 'resolved'

Sat May 15 09:00:17 2010 james [...] now.ie - Fixed in 0.05 added