[jira] [Commented] (NIFI-964) Create a processor to capture PCAP data

["Nasheb Ismaily (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/NIFI-964?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16279372#comment-16279372 ] 

Nasheb Ismaily commented on NIFI-964:
-------------------------------------

I wanted to add a comment regarding the FlowFile Content.

In the current implementation the packet header is added to a FlowFile attribute and to the actual Flowfile content (at least in my case where I'm listening over an Ethernet network)
The packet header has to be manually parsed out of the FlowFile content when performing operations on the TCP/UDP content (in my case joining packets to form a single message). 

Instead, the following line in the code can be updated:

 final Packet payload = packet.getPayload();

To

 final Packet payload = packet.get(TcpPacket.class).getPayload();
 final Packet payload = packet.get(UdpPacket.class).getPayload();

Respectively for TCP/UDP

In this scenario the packet header is not prepended to the actual packet payload and the FlowFile content only contains the actual content of the packet.

> Create a processor to capture PCAP data
> ---------------------------------------
>
>                 Key: NIFI-964
>                 URL: https://issues.apache.org/jira/browse/NIFI-964
>             Project: Apache NiFi
>          Issue Type: Improvement
>            Reporter: Bryan Bende
>            Assignee: Bryan Bende
>            Priority: Minor
>
> There has been interest in using NiFi to capture PCAP data and we should develop a processor that is capable of capturing this data. 
> Some open-source libraries are available to possibly help with this, one option is this one https://github.com/kaitoy/pcap4j



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)