Not able to extract packet payload data

[kishorer747-zz]

There is no function to get hexdump of a packet payload data. There is a function in PcapReader.java in net.ripe.hadoop.pcap package called readPayload() but it takes a packetdata, payloadDataStart and payloadLength parameters.

[wnagele]

You can override the readPayload method and create a HEX dump across that. Feel free to provide back code if it's useful to the rest of the project.

[kishorer747-zz]

Hi,
I know that i have to override the readpayload method. But how do I get the
packetData byte array , packetPayloadStart and packetPayloadLength? Please
help.

Thanks
Kishore

On 29 June 2015 at 15:25, Wolfgang Nagele notifications@github.com wrote:

You can override the readPayload method and create a HEX dump across that.
Feel free to provide back code if it's useful to the rest of the project.

—
Reply to this email directly or view it on GitHub
#30 (comment)
.

Cheers

Kishore
http://kishorer.in

[wnagele]

You don't need to do that. Simply create an extended class (see here for an example https://github.com/RIPE-NCC/hadoop-pcap/blob/master/hadoop-pcap-lib/src/main/java/net/ripe/hadoop/pcap/HashPayloadPcapReader.java). Then use this instead of the PcapReader class.

[kishorer747-zz]

How do i set Pcap reader class in my Mapper? If i use HttpPcapReader
instead of Packet packet = (Packet)value.get(); , i get this
error: Caused by: java.lang.ClassCastException:
net.ripe.hadoop.pcap.packet.Packet cannot be cast to
net.ripe.hadoop.pcap.packet.HttpPacket

I want raw hex dump of HTTP packets. Also how do i set datastream input for
this HttpPcap reader class? Please help.

On 29 June 2015 at 17:25, Wolfgang Nagele notifications@github.com wrote:

Reopened #30 #30.

—
Reply to this email directly or view it on GitHub
#30 (comment).

Cheers

Kishore
http://kishorer.in

[wnagele]

If you wanna write your own runner look here for an example: https://github.com/RIPE-NCC/hadoop-pcap/blob/master/hadoop-pcap-lib/src/main/java/net/ripe/hadoop/pcap/run/PcapReaderRunner.java

[mayank1807]

Dear Sir,
I want to read HTTP payload from packet using Hadoop-pcap. I did not found any method for extracting payload from packet.

[SainathB]

Hi Sir,
In README.md file Configure reader section, I didn't get how to change the value of property net.ripe.hadoop.pcap.io.reader.class. Please help me in this.

Thanks in adavance.

[wnagele]

It's a Java system property so you can specify it when starting the JVM with the -D option.

[mayank1807]

Dear Sir,

I ran example given by you "Example: Count source ports" which ran perfectly but when I make change in mapper class from "Packet packet = (Packet)value.get();" to "HttpPacket packet = (HttpPacket)value.get();" and during runtime I change reader as :
hadoop jar PcapTrial.jar /usr/local/hadoop/input /usr/local/hadoop/output -Dnet.ripe.hadoop.pcap.io.reader.class=net.ripe.hadoop.pcap.HttpPcapReader
then error came as :
java.lang.Exception: java.lang.ClassCastException: net.ripe.hadoop.pcap.packet.Packet cannot be cast to net.ripe.hadoop.pcap.packet.HttpPacket

Please help..!!