Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature pipe captures #280

Open
wants to merge 9 commits into
base: master
Choose a base branch
from

Conversation

CarlyAmar
Copy link
Contributor

Working on enabling PipeCaptures as well as updating a few other features.

It's Work In Progress, so don't merge yet. I just want to make sure you can put in comments early.

@CarlyAmar
Copy link
Contributor Author

Dor, I have a lot of code replication in the PipeRingCapture. Any way I can avoid that?

I overrode _get_tshark_process so it would not spawn dumpcap because tshark can read directly from the pipe.

import tempfile


class DisplayFilterNotAllowedException(Exception):
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Due to how RingCaptures work, Tshark will not allow a display filter in this class.

@KimiNewt
Copy link
Owner

About the code duplication:
Well, first of all make sure that you need LiveCapture's features, so that it's meaningful to capture from it.
Second of all, you can refactor part of the _get_tshark_process method in LiveCapture into a new method called _get_capture_process, which will overridden in PipeRingCapture.

@CarlyAmar
Copy link
Contributor Author

@KimiNewt Looking good now?

:param override_prefs: A dictionary of tshark preferences to override, {PREFERENCE_NAME: PREFERENCE_VALUE, ...}.
:param disable_protocol: Tells tshark to remove a dissector for a specifc protocol.
"""
if display_filter is not None:
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's possible simply not to have it as a parameter in the init and just to write it in the doc. This is a bit more explicit so I'm not 100% about it.



class PipeCapture(Capture):
class PipeCapture(LiveCapture):
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this change not break anything about the previous usage of PipeCapture?
LiveCapture receives an interface as a string, yet here pipe is (unless I'm mistaken) a pipe-like object.


def close(self):
# Close pipe
self._pipe.close()
# self._pipe.close() # Don't close the pipe. This should be the job of whatever is piping into it.
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's fine, but remove this line entirely and add this to the class doc in CAPS or otherwise in an obvious manner

@@ -40,8 +40,10 @@ def get_parameters(self, packet_count=None):
return params[:-1]

def close(self):
# Close pipe
# self._pipe.close() # Don't close the pipe. This should be the job of whatever is piping into it.
"""
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can actually just remove this entire method now, the docs in the classdoc should suffice

@@ -38,10 +38,10 @@ def __init__(self, pipe, ring_file_size=1024, num_ring_files=2, ring_file_name=N
:param override_prefs: A dictionary of tshark preferences to override, {PREFERENCE_NAME: PREFERENCE_VALUE, ...}.
:param disable_protocol: Tells tshark to remove a dissector for a specifc protocol.
"""
if display_filter is not None:
if "display_filter" in kwargs.keys():
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can remove this as well as the exception. I don't think it's needed. Again, just write in the doc that display filters are not supported.

If you feel strongly about having this exception, then it's better the previous way. This is bad because it "swallows" any kwargs the user may have inputted (say they misspelt use_json, it'll suddenly not fail but not work either)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While I agree, I should pass them up to the super, I think it's important to do a hard exception for this since every other capture allows it.

@CarlyAmar
Copy link
Contributor Author

Sorry this one took so long, got busy with some other stuff.

@CarlyAmar CarlyAmar changed the title WIP: Feature pipe captures Feature pipe captures Sep 21, 2018
@aparcar
Copy link

aparcar commented Oct 21, 2024

I'm using a subset of this PR and it works fine. Could you please merge at least the PipeCapture part?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants