[
https://issues.apache.org/jira/browse/DRILL-7852?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Vitalii Diravka updated DRILL-7852:
-----------------------------------
Description:
SUEE8 from [https://github.com/vs-uulm/2017-SUEE-data-set] is a pcapng labeled
with pcap extension. Initially this causes a magic number error where Drill
can't read the file because the extension and magic numbers don't match. We
need to handle that better.
After renaming the file with the pcapng extension Drill can read it and display
it on the CLI but not in the GUI. You get constant errors for running out of
heap memory.
Example Errors:
{code:java}
org.apache.drill.common.exceptions.UserException: RESOURCE ERROR: There is not
enough heap memory to run this query using the web interface.{code}
{code:java}
org.apache.drill.common.exceptions.UserRemoteException: EXECUTION_ERROR ERROR:
Java heap space Open failed for reader: PcapngBatchReader Fragment: 0:0{code}
was:
The _PCAP Next Generation Dump File Format_ (or pcapng for short) [1] is an
attempt to overcome the limitations of the currently widely used (but limited)
libpcap format.
At a first level, it is desirable to query and filter by source and destination
IP and port, and src/dest mac addreses or by protocol. Beyond that, however, it
would be very useful to be able to group packets by TCP session and eventually
to look at packet contents.
Initial work is available at
https://github.com/mapr-demos/drill/tree/pcapng_dev
[1] https://pcapng.github.io/pcapng/
> Handle PCAP/PCAPNG Better
> -------------------------
>
> Key: DRILL-7852
> URL: https://issues.apache.org/jira/browse/DRILL-7852
> Project: Apache Drill
> Issue Type: Improvement
> Components: Storage - PCAP
> Affects Versions: 1.18.0
> Reporter: Vitalii Diravka
> Assignee: Vitalii Diravka
> Priority: Major
> Labels: pcap, pcapng, plugin
> Fix For: 1.19.0
>
>
> SUEE8 from [https://github.com/vs-uulm/2017-SUEE-data-set] is a pcapng
> labeled with pcap extension. Initially this causes a magic number error where
> Drill can't read the file because the extension and magic numbers don't
> match. We need to handle that better.
>
> After renaming the file with the pcapng extension Drill can read it and
> display it on the CLI but not in the GUI. You get constant errors for running
> out of heap memory.
>
> Example Errors:
> {code:java}
> org.apache.drill.common.exceptions.UserException: RESOURCE ERROR: There is
> not enough heap memory to run this query using the web interface.{code}
>
>
> {code:java}
> org.apache.drill.common.exceptions.UserRemoteException: EXECUTION_ERROR
> ERROR: Java heap space Open failed for reader: PcapngBatchReader Fragment:
> 0:0{code}
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
