CLI tool to run SQL queries directly on PCAP files

Edit Package packetq
https://www.dns-oarc.net/tools/packetq

A command line tool to run SQL queries directly on PCAP files, the results
can be outputted as JSON (default), formatted/compact CSV and XML.#
It also contain a very simplistic web-server in order to inspect PCAP files
remotely.
PacketQ was previously known as DNS2db but was renamed in 2011 when it was
rebuilt and could handle protocols other than DNS among other things.

Refresh
Refresh
Source Files
Filename Size Changed
packetq-1.4.1.tar.gz 0000938470 916 KB
packetq.changes 0000001853 1.81 KB
packetq.spec 0000001741 1.7 KB
Revision 2 (latest revision is 4)
Lars Vogdt's avatar Lars Vogdt (lrupp) accepted request 768458 from Martin Hauke's avatar Martin Hauke (mnhauke) (revision 2)
- Update to version 1.4.1
  * Fixed an issue with the in-memory representation of DNS
    records which was not initialized correctly and could cause
    the reuse of old data, especially if the record was incomplete
    (such as FormErr).
- Update to version 1.4.0
  * This release adds new fields for IP version and EDNS0 Client
    Subnet along with documentation updates, new usage (`--help`)
    and a buffer overflow check. Rework of the way OPT records are
    parsed has been done to make it easier to add support for
    other EDNS options in the future.
    New fields:
    + 'ip_version': The IP version as an int (4/6)
    + 'edns0_ecs': A bool that is true if Client Subnet (RFC7871)
       was found
    + 'edns0_ecs_family': An int with the address family
    + 'edns0_ecs_source': An int with the source prefix length
    + 'edns0_ecs_scope': An int with the scope prefix length
    + 'edns0_ecs_address': A textual representation of the address
    Bugfix:
    - 'get_ushort()' in DNS parsing was not checking length of
      buffer before accessing it.
- Update to version 1.3.1
  Fixes:
  * ICMP code to fill the tables was wrong and created segfault
    using normal select, aggregation or group functions. The code
    has been rewritten to work as the DNS code does and ICMP tests
    have been added.
  * Historically PacketQ parses all resource records but only saves
    the first and last record, this would overwrite EDNS information
Comments 0
openSUSE Build Service is sponsored by