Skip to content

Error reading pcap file #12

@duxing

Description

@duxing

Hi Box team,

I'm trying to use memsniff to parse traffic on my memcached server. Due to OS limitation I can't run memsniff directly on the server. Instead I'm looking into running memsniff somewhere else to read the captured pcap files.

however I ran into an error when reading the captured pcap file:
Error from DecodeLayers: No decoder for layer type Unknown

no result is showing in memsniff and the last message I received is Reached EOF, waiting for workers to finish

command used to capture traffic:
tcpdump -nnA -i any "dst port 11211" -s 0 -X -w output.pcap

command used for running memsniff:
memsniff -r output.pcap

tcpdump is executed on a CentOS5 server, and memsniff is built & executed from my laptop (MacOS). I'm using the latest version (as this is written) of memsniff:

memsniff --version
2019/02/05 11:12:47.783652 memsniff version 1.4.0 (revision autopopulated by build.sh)

can you help me figuring out what I did wrong in using memsniff? the same pcap file can be opened fine in wireshark so I figured it's probably the way I used memsniff that's causing this issue.

thanks in advance!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions