You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
4a28879 introduced the ability to dump app metadata to the Pcapng file. However, currently such a data can only be consumed by external tools like Wireshark.
Similarly to what is already implemented when reading from PCAP, it's necessary to add the ability to load the app info from the Pcapng format. However, this requires some major rework on how packets are captured.
Rework the capture to read the packets directly from the PCAP/Pcapng, instead of relying on pcapd (libpcap). See pcapng_to_keylog. This allows reading the raw Pcapng blocks
Read the UID from the Pcapng metadata and set it in the connection data, like done for the PCAP file
Additionally, if the app for the given UID is uninstalled, create a virtual app, using the package name and app name from the Pcapng dump
Evaluate dumping the app icon too
The text was updated successfully, but these errors were encountered:
4a28879 introduced the ability to dump app metadata to the Pcapng file. However, currently such a data can only be consumed by external tools like Wireshark.
Similarly to what is already implemented when reading from PCAP, it's necessary to add the ability to load the app info from the Pcapng format. However, this requires some major rework on how packets are captured.
pcapng_to_keylog
. This allows reading the raw Pcapng blocksThe text was updated successfully, but these errors were encountered: