CapMe: transcript data sometimes overruns the transcript window #1007

Closed
dougburks opened this Issue Sep 29, 2016 · 6 comments

Projects

None yet

2 participants

@dougburks
Contributor

No description provided.

@weslambert

I ran into an issue with a PCAP today -- pulling it resulted in the data from the transcript running across the page (to the right, past the white boundary, to the end of the browser window) -- is this what you are referring to?

Thanks,
Wes

@dougburks
Contributor
dougburks commented Sep 30, 2016 edited

Hi Wes,

Yes, that's exactly what I'm referring to. I ran into it while testing a new version of Sguil, so I was originally thinking it was related to the new version of Sguil, but maybe not.

UPDATE: This is definitely not related to the new version of Sguil that I was testing as I was just able to confirm this issue using our current packages in the STABLE repo.

@dougburks dougburks changed the title from CapMe: rendering issue with new version of Sguil to CapMe: transcript data sometimes overruns the transcript window Sep 30, 2016
@dougburks
Contributor
dougburks commented Sep 30, 2016 edited

Steps to duplicate this issue:

  • replay some traffic:
sudo tcpreplay -ieth1 -M10 /opt/samples/bredo*
  • go to ELSA and search for "tibs 1032"
  • click Info, Plugin, getPcap, and authenticate to CapMe

Should look like this:
screen shot 2016-09-30 at 1 35 04 pm

@weslambert

I was able to fix this by modifying the following in /var/www/so/capme/.css/capme.css

.txtext_src {
display: inline-block;
width: inherit;
overflow: hidden !important;
text-overflow: ellipsis;

color: #0000ff;
}

.txtext_dst {
display: inline-block;
width: inherit;
overflow: hidden !important;
text-overflow: ellipsis;

color: #ff0000;
}

I'll submit a pull request when I get a chance.

Thanks,
Wes

@weslambert weslambert referenced this issue in Security-Onion-Solutions/securityonion-capme Sep 30, 2016
Merged

Issue 1007: CapMe: transcript data sometimes overruns the transcript window #17

@dougburks dougburks closed this Oct 17, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment