Replies: 2 comments 1 reply
-
|
Hi @stanpao, There is no need to reinvent the wheel. There are already awesome solutions that can be used to achieve this. I think, you are trying to use NFStream for something it is not destined for. If you want a PCAP, you can use tcpdump. If you want to achieve packet capture with zero loss, you can use n2disk (nTOP, license is required). Once you have the PCAP, you can use NFStream to generate the flows. You should also be aware of the fact that packet capture in a network with roughly 1Gbps is going to yield a PCAP file of tens of GB in just a couple of minutes or less (unless you want to throw the payload away). |
Beta Was this translation helpful? Give feedback.
-
|
Yes, I got this. Nfstream is a very friendly net flow extraction tool and has great performance. However, flow is the key feature for analysis and payload the the important feature for validation at the same time in some scenarios. Maybe I should choose some middleware for temp payload persistence. Thank you for your reply. I will close this discussion. |
Beta Was this translation helpful? Give feedback.
-
|
@stanpao Even if we expose a buffer with original packet within the NFPacket structure, you will need to store it somewhere and this will led you to drastic performances (memory consumption, disk etc) issues. NFStream is not intended for packet storage but rather flow oriented analytics. That why we expose the payload of each packet, user can do whatever analysis he wants and update a FLOW attribute. Zied |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
As the netflow data source for network traffic machine learning, one of the most important step is to validate if the traffic picked up from massive monitored traffic is as expected. So analyzing packet in the format of flow and keep the original packet bytes to pcap for check is necessary. From the source, there is no way to persist the orginal packet data seemingly (only can obtain L3 data bytes) and from the cffi struct cdeclaration code, there is still no way to read from ffi buffer to get the original data seemingly(I'm not familiar with C ...) So, I ask for help if any practice to realize this function or just can be done by modifing nfstream framework code?
Beta Was this translation helpful? Give feedback.
All reactions