pcap dump parsing issue - tokenizing data error about dissector HOT 4 CLOSED

Logs are created with https://github.com/google/stenographer#querying / stenoread like this:

docker exec -it so-steno stenoread "after 2022-03-07T11:50:00Z and before 2022-03-07T12:00:00Z" -w /tmp/07032022-11_50-12_00.pcap

from dissector.

Interesting... What tool do you use to capture the traffic / generate the PCAP? it seems it does not capture the timestamps

from dissector.

Thanks, I'll check it out and see if I can find how to fix the dissector for this format.

In the meantime you can use tcpdump with a file limit of 1 and a file rotation of x seconds. To capture 10 minutes of traffic: sudo tcpdump -W 1 -G 600 -w /tmp/capture10mins.pcap

from dissector.

Not planned for now

from dissector.