Popularity
5.1
Stable
Activity
0.0
Stable
171
8
16
Programming language: Go
License: MIT License
Latest version: v0.10.2
joincap alternatives and similar packages
Based on the "Other Software" category.
Alternatively, view joincap alternatives based on common mentions on social networks and blogs.
-
-
-
croc
Easily and securely send things from one computer to another :crocodile: :package: -
Seaweed File System
SeaweedFS is a fast distributed storage system for blobs, objects, files, and data lake, for billions of files! Blob store has O(1) disk seek, cloud tiering. Filer supports Cloud Drive, cross-DC active-active replication, Kubernetes, POSIX FUSE mount, S3 API, S3 Gateway, Hadoop, WebDAV, encryption, Erasure Coding. -
Gor
GoReplay is an open-source tool for capturing and replaying live HTTP traffic into a test environment in order to continuously test your system with real data. It can be used to increase confidence in code deployments, configuration changes and infrastructure changes. -
-
limetext
Open source API-compatible alternative to the text editor Sublime Text -
rkt
An App Container runtime that integrates with init systems, is compatible with other container formats like Docker, and supports alternative execution engines like KVM. -
confd
Manage local application configuration files using templates and data from etcd or consul -
toxiproxy
:alarm_clock: :fire: A TCP proxy to simulate network and system conditions for chaos and resiliency testing -
Comcast
Simulating shitty network connections so you can build better systems. -
-
Docker
Notary is a project that allows anyone to have trust over arbitrary collections of data -
scc
Sloc, Cloc and Code: scc is a very fast accurate code counter with complexity calculations and COCOMO estimates written in pure Go -
Juju
Universal Operator Lifecycle Manager (OLM) for Kubernetes operators, and operators for traditional Linux and Windows apps, with declarative integration between operators for automated microservice integration. -
-
-
Stack Up
Super simple deployment tool - think of it like 'make' for a network of servers -
Documize
Modern Confluence alternative designed for internal & external docs, built with Golang + EmberJS -
-
-
blocky
Fast and lightweight DNS proxy as ad-blocker for local network with many features -
GoDNS
A dynamic DNS client tool supports AliDNS, Cloudflare, Google Domains, DNSPod, HE.net & DuckDNS & DreamHost, etc, written in Go. -
peg
Peg, Parsing Expression Grammar, is an implementation of a Packrat parser generator. -
Go Package Store
An app that displays updates for the Go packages in your GOPATH. -
Guora
🖖🏻 A self-hosted Quora like web application written in Go 基于 Golang 类似知乎的私有部署问答应用 包含问答、评论、点赞、管理后台等功能 -
mockingjay
Fake server, Consumer Driven Contracts and help with testing performance from one configuration file with zero system dependencies and no coding whatsoever -
ipe
An open source Pusher server implementation compatible with Pusher client libraries written in GO -
-
-
-
tcpprobe
Modern TCP tool and service for network performance observability. -
OPS - Build and Run Open Source Unikernels
Quickly and easily build and deploy open source unikernels in tens of seconds. Deploy in any language to any cloud.
Promo
github.com/nanovms
* Code Quality Rankings and insights are calculated and provided by Lumnify.
They vary from L1 to L5 with "L5" being the highest.
Do you think we are missing an alternative of joincap or a related project?
|
Deliver Cleaner and Safer Code - Right in Your IDE of Choice!
sponsored
www.sonarlint.org
|
Popular Comparisons
|
Less time debugging, more time building
sponsored
scoutapm.com
|
README
joincap
Merge multiple pcap files together, gracefully.
Installation
- Download a precompiled binary from https://github.com/assafmo/joincap/releases
- Or... Use
go get:
go get -u github.com/assafmo/joincap
- Or use Ubuntu PPA:
curl -SsL https://assafmo.github.io/ppa/ubuntu/KEY.gpg | sudo apt-key add -
sudo curl -SsL -o /etc/apt/sources.list.d/assafmo.list https://assafmo.github.io/ppa/ubuntu/assafmo.list
sudo apt update
sudo apt install joincap
Basic Usage
Usage:
joincap [OPTIONS] InFiles...
Application Options:
-v, --verbose Explain when skipping packets or entire input files
-V, --version Print the version and exit
-w= Sets the output filename. If the name is '-', stdout will be used (default: -)
Help Options:
-h, --help Show this help message
Why?
I believe skipping corrupt packets is better than failing the entire merge job.
When using tcpslice or mergecap sometimes pcapfix is needed to fix bad input pcap files.
- One option is to try and run merge (
mergecap/tcpslice), if we get errors then runpcapfixon the bad pcaps and then run merge again.- Adds complexity (run -> check errors -> fix -> rerun)
- (If errors) Demands more resources (
pcapfixprocesses) - (If errors) Extends the total run time
- Another option is to run
pcapfixon the input pcap files and then merge.- Extends the total run time by a lot (read and write each pcap twice instead of once)
- Demands more storage (for the fixed pcaps)
- Demands more resources (
pcapfixprocesses)
- We can use
pcapfix"in memory" with process substitution:mergecap -w out.pcap <(pcapfix -o /dev/stdout 1.pcap) <(pcapfix -o /dev/stdout 2.pcap).- Adds complexity (build a complex command line)
- Demands more resources (
pcapfixprocesses) - Harder for us to use pathname expansion (e.g.
tcpslice -w out.pcap *.pcap) - We have to mind the command line character limit (in case of long pathnames)
- Doesn't work for
tcpslice(seeks the last packets to calculate time ranges - cannot do this with pipes)
Error handling: joincap vs mergecap vs tcpslice
Results
| Use case | joincap | mergecap v2.4.5 | tcpslice v1.2a3 |
|---|---|---|---|
| Corrupt input global header | :heavy_check_mark: | :x: | :x: |
| Corrupt input packet header | :heavy_check_mark: | :x: | :x: |
| Unexpectd EOF(last packet data is truncated) | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
| Input pcap has no packets(global header is ok, no first packet header) | :heavy_check_mark: | :heavy_check_mark: | :x: |
| Input file size is smaller than 24 bytes(global header is truncated) | :heavy_check_mark: | :heavy_check_mark: | :x: |
| Input file size is between 24 and 40 bytes(global header is ok, first packet header is truncated) | :heavy_check_mark: | :x: | :x: |
| Input file doesn't exists | :heavy_check_mark: | :x: | :x: |
| Input file is a directory | :heavy_check_mark: | :x: | :x: |
| Input file end is garbage | :heavy_check_mark: | :heavy_check_mark: | :x: |
| Input file is gzipped (.pcap.gz) | :heavy_check_mark: | :heavy_check_mark: | :x: |
Error outputs
| Use case | Error outputs |
|---|---|
| Corrupt input global header | tcpslice: bad tcpdump file test_pcaps/bad_global.pcap: archaic pcap savefile formatmergecap: The file "test_pcaps/bad_global.pcap" contains record data that mergecap doesn't support. (pcap: major version 0 unsupported) |
| Corrupt input packet header | tcpslice: Infinite loop?mergecap: The file "test_pcaps/bad_first_header.pcap" appears to be damaged or corrupt. (pcap: File has 2368110654-byte packet, bigger than maximum of 262144) |
| Unexpectd EOF(last packet data is truncated) | |
| Input pcap has no packets(global header is ok, no first packet header) | tcpslice: Outputs empty pcap (Only global header) |
| Input file size is smaller than 24 bytes(global header is truncated) | tcpslice: bad tcpdump file test_pcaps/empty: truncated dump file; tried to read 4 file header bytes, only got 0 |
| Input file size is between 24 and 40 bytes(global header is ok, first packet header is truncated) | tcpslice: bad status reading first packet in test_pcaps/partial_first_header.pcap: truncated dump file; tried to read 16 header bytes, only got 11mergecap: The file "test_pcaps/partial_first_header.pcap" appears to have been cut short in the middle of a paket. |
| Input file doesn't exists | tcpslice: bad tcpdump file ./not_here: ./not_here: No such file or directorymergecap: The file "./not_here" doesn't exist. |
| Input file is a directory | tcpslice: bad tcpdump file examples: error reading dump file: Is a directorymergecap: "examples" is a directory (folder), not a file. |
| Input file end is garbage | tcpslice: problems finding end packet of file test_pcaps/bad_end.pcap |
| Input file is gzipped (.pcap.gz) | tcpslice: bad tcpdump file test_pcaps/ok.pcap.gz: unknown file format |
How to reproduce
| Use case | How to reproduce |
|---|---|
| Corrupt input global header | joincap -w out_joincap.pcap test_pcaps/bad_global.pcapmergecap -w out_mergecap.pcap test_pcaps/bad_global.pcaptcpslice -D -w out_tcpslice.pcap test_pcaps/bad_global.pcap |
| Corrupt input packet header | joincap -w out_joincap.pcap test_pcaps/bad_first_header.pcapmergecap -w out_mergecap.pcap test_pcaps/bad_first_header.pcaptcpslice -D -w out_tcpslice.pcap test_pcaps/bad_first_header.pcap |
| Unexpectd EOF(last packet data is truncated) | joincap -w out_joincap.pcap test_pcaps/unexpected_eof_on_first_packet.pcapmergecap -w out_mergecap.pcap test_pcaps/unexpected_eof_on_first_packet.pcaptcpslice -D -w out_tcpslice.pcap test_pcaps/unexpected_eof_on_first_packet.pcapjoincap -w out_joincap.pcap test_pcaps/unexpected_eof_on_second_packet.pcapmergecap -w out_mergecap.pcap test_pcaps/unexpected_eof_on_second_packet.pcaptcpslice -D -w out_tcpslice.pcap test_pcaps/unexpected_eof_on_second_packet.pcap |
| Input pcap has no packets(global header is ok, no first packet header) | joincap -w out_joincap.pcap test_pcaps/ok.pcap test_pcaps/no_packets.pcapmergecap -w out_mergecap.pcap test_pcaps/ok.pcap test_pcaps/no_packets.pcaptcpslice -D -w out_tcpslice.pcap test_pcaps/ok.pcap test_pcaps/no_packets.pcap |
| Input file size is smaller than 24 bytes(global header is truncated) | joincap -w out_joincap.pcap test_pcaps/ok.pcap test_pcaps/emptymergecap -w out_mergecap.pcap test_pcaps/ok.pcap test_pcaps/emptytcpslice -D -w out_tcpslice.pcap test_pcaps/ok.pcap test_pcaps/emptyjoincap -w out_joincap.pcap test_pcaps/ok.pcap test_pcaps/partial_global_header.pcapmergecap -w out_mergecap.pcap test_pcaps/ok.pcap test_pcaps/partial_global_header.pcaptcpslic -De -w out_tcpslice.pcap test_pcaps/ok.pcap test_pcaps/partial_global_header.pcap |
| Input file size is between 24 and 40 bytes(global header is ok, first packet header is truncated) | joincap -w out_joincap.pcap test_pcaps/ok.pcap test_pcaps/partial_first_header.pcapmergecap -w out_mergecap.pcap test_pcaps/ok.pcap test_pcaps/partial_first_header.pcaptcpslic -De -w out_tcpslice.pcap test_pcaps/ok.pcap test_pcaps/partial_first_header.pcap |
| Input file doesn't exists | joincap -w out_joincap.pcap test_pcaps/ok.pcap ./not_heremergecap -w out_mergecap.pcap test_pcaps/ok.pcap ./not_heretcpslice -D -w out_tcpslice.pcap test_pcaps/ok.pcap ./not_here |
| Input file is a directory | joincap -w out_joincap.pcap test_pcaps/ok.pcap test_pcaps/mergecap -w out_mergecap.pcap test_pcaps/ok.pcap test_pcaps/tcpslice -D -w out_tcpslice.pcap test_pcaps/ok.pcap test_pcaps/ |
| Input file end is garbage | joincap -w out_joincap.pcap test_pcaps/ok.pcap test_pcaps/bad_end.pcapmergecap -w out_mergecap.pcap test_pcaps/ok.pcap test_pcaps/bad_end.pcaptcpslice -D -w out_tcpslice.pcap test_pcaps/ok.pcap test_pcaps/bad_end.pcap |
| Input file is gzipped (.pcap.gz) | joincap -w out_joincap.pcap test_pcaps/ok.pcap.gzmergecap -w out_mergecap.pcap test_pcaps/ok.pcap.gztcpslice -D -w out_tcpslice.pcap test_pcaps/ok.pcap.gz |
Benchmarks
| Version | Speed | Time | |
|---|---|---|---|
| mergecap | 3.2.2 | 590MiB/s | 0m5.632s |
| tcpslice | 1.2a3 | 838MiB/s | 0m3.666s |
| joincap | 0.10.2 | 562MiB/s | 0m5.462s |
- Merging 3 files with total size of 2.99994GiB.
- Running on Linux 5.4.0-21-generic, with Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz (with SSE4.2), with 31765 MB of physical memory, with locale C, with zlib 1.2.11.