[Converting PCAP file] Changing encapsulation type from NFLOG to Raw IP

asked 2021-03-19 08:27:48 +0000

p11188536
1 ●1 ●2 ●3

I'm using the pcap file captured by tshark & Suricata to work with ntop program on the offline mode( read pcap file from directory).

In ntop, the file captured with Suricata has output, but the file captured with tshark has no output. image description

I did some research and found the difference within the two pcap file. The encapsulation type using Suricata is Raw IP while the other is NFLOG. Thus, I need to change the encapsulation type.

$ capinfos  "/Volumes/APFS TOSHIBA/Tor Router/20210318/tor.pcap000"
File name:           /Volumes/APFS TOSHIBA/Tor Router/20210318/tor.pcap000
File type:           Wireshark/tcpdump/... - pcap
File encapsulation:  NFLOG
...
$ capinfos "/Volumes/APFS TOSHIBA/Tor Router/20210315/benign/merged.pcap"
File name:           /Volumes/APFS TOSHIBA/Tor Router/20210315/benign/merged.pcap
File type:           Wireshark/tcpdump/... - pcap
File encapsulation:  Raw IP

However, editcap -F pcap -T rawip merely forces the encapsulation type of the output fileto be the specified type; the packet headers of the packets do not be translated from the encapsulation type of the input capture file to the specified encapsulation type. Thus, I'm wondering is there any other way to change encapsulation type from NFLOG to Raw IP?

answered 2021-03-19 20:24:20 +0000

Guy Harris
19890 ●3 ●659 ●207

Thus, I'm wondering is there any other way to change encapsulation type from NFLOG to Raw IP?

Not with any tool provided by Wireshark.

Is there some reason why you're capturing on an nflog device? If ntop only handles Raw IP, then it's not very useful, as it wouldn't be able to handle, for example, a straightforward Ethernet capture. As such, I suspect the problem isn't that it requires Raw IP, but that it doesn't understand NFLOG captures.

If you can capture on one particular device, that traffic might be readable by ntop. If not, perhaps ntop can handle LINUX_SLL captures, so you could try capturing on the "any" device (if you're getting an NFLOG capture, you're capturing on Linux, so you can also capture on the "any" device).

edit flag offensive delete link

Comments

A quick look at the ntop and nDPI code suggests that 1) it handles Ethernet and LINUX_SLL and 2) it, not surprisingly, does not handle NFLOG.

I suggest you capture on something other than an nflog device if you want to feed the result to ntop.

Guy Harris ( 2021-03-20 00:03:06 +0000 )edit

Thanks for your reply! I have to use NFLOG type because I need to filter selectively IP addresses in a very big amount with iptables. I will take a look about LINUX_SLL!

p11188536 ( 2021-03-20 04:19:39 +0000 )edit

I have to use NFLOG type because I need to filter selectively IP addresses in a very big amount with iptables.

That sounds more like "I have to capture on an nflog device because....". Therefore:

I will take a look about LINUX_SLL!

...you probably don't have that choice; as far as I know, the "any" device, like devices corresponding to particular interfaces, provides packets before they're processed by iptables.

Guy Harris ( 2021-03-20 13:35:21 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

[Converting PCAP file] Changing encapsulation type from NFLOG to Raw IP

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

[Converting PCAP file] Changing encapsulation type from NFLOG to Raw IP edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

[Converting PCAP file] Changing encapsulation type from NFLOG to Raw IP