Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

netsniff-ng may be HUP'ed incorrectly if the PCAP processing directory is backlogged #36

Closed
mmguero opened this issue Jul 11, 2019 · 0 comments

Comments

@mmguero
Copy link
Collaborator

mmguero commented Jul 11, 2019

This is very similar to issue #34.

The pcap-capture/scripts/netsniff-roll.sh script which is executed in the context of the pcap-capture container is responsible for making sure that netsniff-ng is HUP'ed if the PCAP file it is writing to exceeds the value for the PCAP_ROTATE_MINUTES environment variable (the PCAP_ROTATE_MEGABYTES value is actually handled by netsniff-ng itself with the -F argument).

However, if the pcap/upload directory is very full, the same files will be viewed multiple times. This will cause the thing to hup netsniff-ng every few seconds.

Possible fixes:

  • capture to a different directory than the uploads (does slightly complicate things)
  • only HUP netsniff-ng for the most recent PCAP file per-process, rather than all of them (probably the easiest solution?)
  • only HUP netsniff-ng for PCAP files that are newer than the last time we hupped that process (also probably pretty easy)
@mmguero mmguero added bug Something isn't working capture Relating to pcap-capture container labels Jul 11, 2019
mmguero added a commit that referenced this issue Jul 12, 2019
@mmguero mmguero closed this as completed Jul 12, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant