Add command-line option to write unprocessed packets to a file

This commit also changes the PcapDumper to automatically flush after
every called to Dump(). This is because pcap_dump has an internal buffer
of some sort that only writes to the file after a set amount of bytes.
When using the new option on a low-traffic network, it might be a while
before you see any packets written since it has to overcome that buffer
limit first.
This commit is contained in:
Tim Wojtulewicz 2021-11-08 11:04:40 -07:00
parent fe932944c4
commit 92b84a00f9
6 changed files with 35 additions and 9 deletions

View file

@ -18,6 +18,11 @@ namespace detail
class PacketProfiler;
}
namespace iosource
{
class PktDumper;
}
namespace packet_analysis
{
@ -40,8 +45,12 @@ public:
/**
* Second-stage initialization of the manager. This is called late
* during Zeek's initialization after any scripts are processed.
*
* @param unprocessed_output_file A path to a file where unprocessed
* packets will be written. This can be an empty string to disable
* writing packets.
*/
void InitPostScript();
void InitPostScript(const std::string& unprocessed_output_file);
/**
* Finished the manager's operations.
@ -172,6 +181,7 @@ private:
uint64_t unknown_first_bytes_count = 0;
uint64_t total_not_processed = 0;
iosource::PktDumper* unprocessed_dumper = nullptr;
};
} // namespace packet_analysis