catalyst256 / gobbler Goto Github PK

on some pcap files you get the following exception [Errno 49] Can't assign requested address...

This is using the TCP listener on Splunk. Not related to volume of packets as I have uploaded more that the 38K+ in the sample pcap.

According to Splunk documentation that's a "feature" when using UDP listeners. Can be resolved and will do so when creating the Splunk app. For now TCP listeners are working fine, even on large pcaps.

Need to work out how to add TCP and UDP stream indexes to packet information.

With the way that Scapy sometimes stacks layers (like DNSQR & DNSRR), when trying to create a python dict you get the above error. Need to work out how to exclude those keys as this allow the next layer to be presented which includes those "missing" fields.

Example of "bad layers"

IP version=4L ihl=6L tos=0x0 len=32 id=7166 flags= frag=0L ttl=1 proto=igmp chksum=0xfac2 src=128.12.173.14 dst=224.0.0.252 options=IPOption_Router_Alert copy_flag=1L optclass=control option=router_alert length=4 alert=router_shall_examine_packet Raw load='\x16\x00\t\x03\xe0\x00\x00\xfc'

Traceback (most recent call last):
File "/usr/local/bin/gobbler", line 5, in
pkg_resources.run_script('gobbler==0.1.4', 'gobbler')
File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources.py", line 489, in run_script
self.require(requires)[0].run_script(script_name, ns)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources.py", line 1214, in run_script
exec script_code in namespace, namespace
File "/Library/Python/2.7/site-packages/gobbler-0.1.4-py2.7.egg/EGG-INFO/scripts/gobbler", line 119, in

File "/Library/Python/2.7/site-packages/gobbler-0.1.4-py2.7.egg/EGG-INFO/scripts/gobbler", line 109, in main

File "build/bdist.macosx-10.9-intel/egg/gobbler/parsers/loadpackets.py", line 24, in loadpackets
File "/Library/Python/2.7/site-packages/scapy/utils.py", line 476, in rdpcap
return PcapReader(filename).read_all(count=count)
File "/Library/Python/2.7/site-packages/scapy/utils.py", line 572, in init
RawPcapReader.init(self, filename)
File "/Library/Python/2.7/site-packages/scapy/utils.py", line 496, in init
raise Scapy_Exception("Not a pcap capture file (bad magic)")
scapy.error.Scapy_Exception: Not a pcap capture file (bad magic)