I was testing pulsar with PCAP files containing DNS traffic and discovered that the re

I had not seen this problem so far. Could it be an issue with the <code class="notrans

Bug in filter.py? about pulsar HOT 3 CLOSED

hgascon commented on September 28, 2024

Bug in filter.py?

from pulsar.

Comments (3)

hgascon commented on September 28, 2024

Have you done a test with a TCP capture?

from pulsar.

tg-mw commented on September 28, 2024

Thank you for your answer. The initial test was DNS over UDP. I generated new samples containing DNS over TCP and there seems to be a similar problem, even though the responses are sometimes displayed correctly:

dialogId        msgNumber       origin  type
0       0       UAC     %00:%9f%83%01
0       1       UAC     NONE
1       0       UAC     %008%9f%eb%01
1       1       UAS     %00`%9f%eb%81%83%00%01%00%00%00%01%00%01 [...]
1       2       UAC     NONE
2       0       UAC     %009%d8%0e%01
2       1       UAC     NONE
[...]

With the aforementioned change, the .harry file contains:

dialogId        msgNumber       origin  type
0       0       UAC     %00:%9f%83%01
0       1       UAS     %00b%9f%83%81%83%00%01%00%00%00%01%00 [...]
0       2       UAC     NONE
1       0       UAC     %008%9f%eb%01
1       1       UAS     %00`%9f%eb%81%83%00%01%00%00%00%01%00 [...]
1       2       UAC     NONE
2       0       UAC     %009%d8%0e%01
2       1       UAS     %00=%d8%0e%81%80%00%01%00%01%00%00%00 [...]
2       2       UAC     NONE
[...]

Here, each dialogId has an UAC and UAS entry and the markovModel seems to be correct. Does it work for you without the modification?

from pulsar.

hgascon commented on September 28, 2024

I had not seen this problem so far. Could it be an issue with the step parameter in pulsar/pulsar/conf/harry.conf? The default value is set to 10ms.

from pulsar.

Recommend Projects