Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

can't read "start_file": no such variable #42

Open
dougburks opened this issue Oct 21, 2016 · 2 comments
Open

can't read "start_file": no such variable #42

dougburks opened this issue Oct 21, 2016 · 2 comments

Comments

@dougburks
Copy link

Hi Bamm,

I'm experimenting with your latest code from github and am especially excited about being able to get transcripts for TCP streams that span multiple pcap files (23e40a8)!

However, if I take a fresh database and immediately generate some alerts and then pivot to transcript, I get an error like this:
screen shot 2016-10-21 at 10 54 08 am

If I'm reading the code correctly:

I think this is somewhat of a corner case and should really only happen within the first 2 minutes of starting Sguil. I suppose I could shorten $BACK_SECONDS to something smaller like 60 to decrease the likelihood of a user running into this. But I'm wondering if it might be better to add some code here:
https://github.com/bammv/sguil/blob/master/sensor/pcap_agent.tcl#L349

to check and see if $start_file is null and, if so, set it to the earliest pcap available.

Any thoughts?

Thanks!

@jmtaylor90
Copy link
Contributor

There is also an issue with pulling pcap/transcript for alerts that come in at 0000. The $start_file error will also occur in a scenario where the back occurs in the previous day. I haven't had a chance to mock up anything to address the previous day issue but would be curious what you have in mind for this @dougburks or @bammv

@bammv
Copy link
Owner

bammv commented Apr 15, 2017

I uploaded an update to pcap_agent.tcl to day. Please let me know if it corrected the issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants