mirror of
https://github.com/zeek/zeek.git
synced 2025-10-05 16:18:19 +00:00
Add command-line option to write unprocessed packets to a file
This commit also changes the PcapDumper to automatically flush after every called to Dump(). This is because pcap_dump has an internal buffer of some sort that only writes to the file after a set amount of bytes. When using the new option on a low-traffic network, it might be a while before you see any packets written since it has to overcome that buffer limit first.
This commit is contained in:
parent
fe932944c4
commit
92b84a00f9
6 changed files with 35 additions and 9 deletions
|
@ -18,6 +18,11 @@ namespace detail
|
|||
class PacketProfiler;
|
||||
}
|
||||
|
||||
namespace iosource
|
||||
{
|
||||
class PktDumper;
|
||||
}
|
||||
|
||||
namespace packet_analysis
|
||||
{
|
||||
|
||||
|
@ -40,8 +45,12 @@ public:
|
|||
/**
|
||||
* Second-stage initialization of the manager. This is called late
|
||||
* during Zeek's initialization after any scripts are processed.
|
||||
*
|
||||
* @param unprocessed_output_file A path to a file where unprocessed
|
||||
* packets will be written. This can be an empty string to disable
|
||||
* writing packets.
|
||||
*/
|
||||
void InitPostScript();
|
||||
void InitPostScript(const std::string& unprocessed_output_file);
|
||||
|
||||
/**
|
||||
* Finished the manager's operations.
|
||||
|
@ -172,6 +181,7 @@ private:
|
|||
uint64_t unknown_first_bytes_count = 0;
|
||||
|
||||
uint64_t total_not_processed = 0;
|
||||
iosource::PktDumper* unprocessed_dumper = nullptr;
|
||||
};
|
||||
|
||||
} // namespace packet_analysis
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue