lonfee88 / pcaphar Goto Github PK

What steps will reproduce the problem?
1.upload the attached file
2.an error occured messge is reported
3.

What is the expected output? What do you see instead?


What version of the product are you using? On what operating system?


Please provide any additional information below.

Fixes issue #3.

What steps will reproduce the problem?
1. Capture pcap traffic when some data use MIME Multipart Media Encapsulation 
in HTTP POST request.
2. Upload the pcap file to convert to har

What is the expected output? What do you see instead?
Expected to get the har file, instead get "A error has happend when trying to 
convert your PCAP file to HAR file. " when trying to convert.

What version of the product are you using? On what operating system?
Google's PCAP Web Performance Analyzer which contains pcaphar to convert pcap 
file to har file. And Google make some changes to fit its app engine.
The appengine is set locally on my computer, and the OS is Win7.

Please provide any additional information below.

Exception encountered.

<type 'exceptions.SyntaxError'>: invalid syntax (convert.py, line 26)
Traceback (most recent call last):
  File "/base/data/home/apps/pcaphar/1.346614459514948946/pcaphar.py", line 41, in <module>
    from pcap2har import convert
<type 'exceptions.SyntaxError'>: invalid syntax (convert.py, line 26)

What steps will reproduce the problem?
1.
2.
3.

What is the expected output? What do you see instead?


What version of the product are you using? On what operating system?


Please provide any additional information below.

Fixes issue #6.

Currently, all the captured traffic is parsed into one page in HAR. We need to 
find a good way to break up pages. Simply using "referer" does not work, 
because we cannot differentiate frames, resources, or clicks.

Hello,

I want convert a pcap file in a har file using pcap2har project.

Running the following command:

"python ./main.py dns_requests.pcap dns_requests.har"

I am getting an error:

ImportError: No module named resource

I attach the details of the problem.

Please, can you provide possible solutions for this case.

Thanks in advance
Regards

DNS timings are all -1. Looking at the log seems that the DNS timing is 
observed, but not able to retrieve from the global variable. Running pcap2har 
as a standalone application does not have this problem.

What steps will reproduce the problem?
1. get tcpdump of ios devices from OS X virtual interface. That interface 
support only RAW (Raw IP) as data link type.
2. upload tcpdump to http://pcapperf.appspot.com/
3. response is that "A error has happend when trying to convert your PCAP file 
to HAR file."

What is the expected output? What do you see instead?
pcapperf.appspot.com is using pcaphar as internal module, but it seems that to 
fail converting from tcpdump to had when data link type is raw.

What version of the product are you using? On what operating system?
I don't know what version is used at pcapperf.appspot.com

Please provide any additional information below.
I attach example file that fail to convert

Known issues:
- DNS timings
- Connection timings
- Paging (incorrectly break up pages)
- Mis-parsed some HTTP headers (fixed in dpkt trunk)

AppEngine does not support writing to the filesystem. We need change the input 
and output to use StringIO while keep the file read/write interface.

What steps will reproduce the problem?
1. Create har file without the har extension.
2. Try and analyze it. 
3. Error: Check your uploaded file format: FILENAME.
4. Rename to FILENAME.har and reupload.
5. Har file is analyzed.

What is the expected output? What do you see instead?

I would expect it to detect valid har data inside of the file, not the 
extension of the file.

1. Question:  Not having browser feedback prevents knowing when the page was 
complete and what is the reason for time gaps in network activity.
   Is it possible to infer browsing behavior such as blocked Rendering from a pcap file?

2. Request: The feature which would be nice to have is getting two sides pcacp 
files from both Server and Client (at the same time) and comparing them. I 
think this way you can get more information about why things went wrong (such 
as browser being busy and the client kernel TCP stack and buffers etc.)

Do you have any notes to setup the tool on apache ?

I can get the pages setup but the output of the waterfall is blank

What steps will reproduce the problem?
1. running with a tcpdump -w <file>
2.uploading the file



What is the expected output? What do you see instead?

The HAR output - instead I got an error.


What version of the product are you using? On what operating system?


Please provide any additional information below.





50% of my tcpdump -w outputs work the other half doesnt. 

Is there a problem with tcpdump -w and this?

What steps will reproduce the problem?

1. go to http://pcapperf.appspot.com/
2. click on "PageSpeed" link for example 1

What is the expected output? What do you see instead?

An error message is shown, saying: "Error: Server Error. The server encountered 
an error and could not complete your request. If the problem persists, please 
report your problem and mention this error message and the query that caused 
it."

can some one provide the instruction to install pcaphar viewer software locally 
on windows machine.

Many small changes to make pcap2har run in AppEngine.
Fixes issue #2.

What steps will reproduce the problem?
1. Capture pcap traffic when some data packets are dropped.
2. Upload the pcapfile to convert to har
3. Compare the request/response against them in Wireshark

What is the expected output? What do you see instead?
Expected same request/response, instead some of the request/response is missing.

In the capture file, there maybe some TCP/HTTP traffics that were started 
before the beginning of the capture. Ignore traffics in those connections.

What steps will reproduce the problem?
1. I'm using Wireshark to create *.pcap files from HTTP traffic sent from my 
Android smartphone (using the tutorial on your appspot page - even though I'm 
using a software for the wifi-hotspot).
2. Then I'm uploading the pcap file.

What is the expected output? What do you see instead?

I thought I'm going to see a waterfall chart of the HTTP requests and the pie 
charts. But instead it's just showing empty statistics (pie charts).

What version of the product are you using? On what operating system?

Wireshark 1.10.1 for tracking and Connectify for the wifi-hotspot. OS is 
Windows 7 Pro.

Please provide any additional information below.

I have attached a pcap file that reproduces the problem, as well as a 
screenshot of the outcome. In Wireshark's "Capture Options" I deactivated "Use 
pcap-ng format" since pcap2har is not supporting it yet.

Few days ago parsing the pcap files captured the same way using the same 
devices was fine

*What steps will reproduce the problem?*
1. Try uploading a pcap file (attached) to http://pcapperf.appspot.com/

*What is the expected output? What do you see instead?*
Expected: Converted HAR file waterfall
Actual: A error has happend when trying to convert your PCAP file to HAR file. 
Check your uploaded file format: 
2013-Oct-1-3G-Galaxy-S2-sandbox-roller-after-nubs.pcap.

*What version of the product are you using? On what operating system?*
Packets captured by Wireshark running on Mac OS X using steps from here - 
https://code.google.com/p/pcaphar/wiki/CaptureMobileTraffics

Using whichever version of pcapperf that's online at 
http://pcapperf.appspot.com/ on Oct 1, 2013 (can't see the version string 
anywhere)

What steps will reproduce the problem?
1. Upload 05-03_gn_d.pcap to http://pcapperf.appspot.com/
2. Compare output from pcapperf to that in the attached 
Rq-and-Rs_fromWireshark.txt.  


What is the expected output? What do you see instead?

For example, the text "CorrespdnceAddOperRq" shows up in the wireshark 
data(Rq-and-Rs_fromWireshark.txt), but I couldn't find it in pcapperf.
The response data looks fine -- just can't see the request.


What version of the product are you using? On what operating system?

I'm using the online version of http://pcapperf.appspot.com/ on July 20, 2011.

Please provide any additional information below.

Support pcap files that has IPv6 traffics.

What steps will reproduce the problem?
1.Upload attached pcap 10kplus.pcap
2. After upload an error is reported to open a bug


What is the expected output? What do you see instead?
HAR data is generated

What steps will reproduce the problem?
1. As you know, I don't visit http://pcapperf.appspot.com from China.
2. I have to use proxy on the browser.
3. Use Chrome or Firefox with gogant, it can visit 
facebook、youtube、twitter. But it could not visit http://pcapperf.appspot.com

What is the expected output? What do you see instead?
It can visit http://pcapperf.appspot.com


What version of the product are you using? On what operating system?
Windows 7/Windows XP


Please provide any additional information below.

Integrate with HarViewer (http://www.softwareishard.com/har/viewer/). Make it 
convenient to view the waterfall chart.

The application currently always runs at / when run using Google AppEngine. 
Modifying the app.yaml file will allow you to modify where the server is 
looking for files, but the application itself has a large number of hardcoded 
paths. The feature request in it's simplest form would be to convert all links 
within the application to be relative. The more advanced version would be to 
also provide a single place to specify the root path for the application to run 
at instead of having the user edit the app.yaml file.

Use case:

I want to run pcap2har behind a proxy which converts from hostname:port/ to 
hostname/pcap2har/. Proxying from / to /pcap2har/ is extremely difficult even 
with HTML rewrite enabled. Having the application use relative links and a 
configurable base path would make this much easier.

Provide some example PCAP files, so that people can try it out.