tomahawkd / jflowinspector

JFlowInspector is a tool to inspect network traffic, identify network flows and extract preset features to CSV file.

Tomahawkd's repo

• Projects during university career

• Useful tools developed from projects

• Programming ideas

• Also my personal blog

jflowinspector's Issues

API system

Add API for feature parsing and packet parsing.
The packet parsing has two steps, PCAP/PCAPNG file parsing and protocol parsing.

Enhanced Binary Parser Needed

Current packet parser extracts and copies the protocol fields to intermidiate data strcuture PacketInfo.
Preserving the original binary data and extracting the field while requesting could reduce the memory used.

OfflineExecutor System.out Slows Down the Main Thread

In function readData, the while loop calls sysout in every loop, which slows down the packet parsing procedure in the terminal.
Using a timer or another thread for output to update the status string could help.

System.out.printf("%s -> Total: %d,Valid: %d,Discarded: %d, %d flows \r", 
    filePath.getFileName(), nTotal, nValid, nInvalid, dispatcher.getFlowCount());

Duplicated Feature Builder Functionality

A duplicated functionality in io.tomahawkd.jflowinspector.flow.features.FlowFeatureBuilder and io.tomahawkd.jflowinspector.flow.features.http.HttpFeatureBuilder.

A fully functional TCP analyser

ACK number and SACK TCP option is not used in analyser, which could detect necessary retransmission.
Moreover, building a simulator to replay the traffic is needed.