2

I'm trying to build a transparent proxy in Java with the ability to record data that passed through to be viewed later in wireshark.

I was able to get the proxy working correctly with this snippet 

private static final int BUFFER_SIZE = 8192;

...

public void run() {
    PcapHandle handle = null;
    PcapDumper dumper;
    try {
        InetAddress addr = InetAddress.getByName("localhost");
        PcapNetworkInterface nif = Pcaps.getDevByAddress(addr);
        int snapLen = 65536;
        PcapNetworkInterface.PromiscuousMode mode = PcapNetworkInterface.PromiscuousMode.PROMISCUOUS;
        int timeout = 10;
        handle = nif.openLive(snapLen, mode, timeout);
        dumper = handle.dumpOpen("cap.pcap");
        byte[] buffer = new byte[BUFFER_SIZE];
        try {
            while (true) {
                int bytesRead = mInputStream.read(buffer);
                if (bytesRead == -1)
                    break; // End of stream is reached --> exit
                mOutputStream.write(buffer, 0, bytesRead);
                dumper.dumpRaw(Arrays.copyOfRange(buffer, 0, bytesRead));                    
                mOutputStream.flush();
            }
        } catch (IOException e) {
            // Read/write failed --> connection is broken
        }
        dumper.close();
    } catch (PcapNativeException e) {
        e.printStackTrace();
    } catch (UnknownHostException e) {
        e.printStackTrace();
    } catch (NotOpenException e) {
        e.printStackTrace();
    }
}

As you may notice I'm using Pcap4J to store raw bytes into a pcap file. The saving of the bytes works well but when I try to open it on wireshark it shows this message:

Error

And every packet shows as malformed. Ideally I would be seeing TCP and CQL (Cassandra) packets.

Can anyone tell me what I'm doing wrong here?

ggfpc
  • 86
  • 8
  • @KarolDowbecki It's 8192, I edited the post to reflect that. – ggfpc Nov 19 '18 at 20:15
  • Are you running on Windows or Linux ? Check the file correctly starts with the magic bytes as suggested on [Hani's blog](http://www.kroosec.com/2012/10/a-look-at-pcap-file-format.html). The problem can be further, but let's start by the beginning. – Eugène Adell Nov 19 '18 at 22:12
  • @EugèneAdell I'm running Ubuntu. I managed to surpass the error by only writing to the file the amount of data read from the inputstream instead of the full buffer, but every packet looks like an ethernet packet in wireshark instead of CQL – ggfpc Nov 20 '18 at 12:36

0 Answers0