{"action":"created","issue":{"url":"https://api.github.com/repos/iclab/centinel/issues/141","labels_url":"https://api.github.com/repos/iclab/centinel/issues/141/labels{/name}","comments_url":"https://api.github.com/repos/iclab/centinel/issues/141/comments","events_url":"https://api.github.com/repos/iclab/centinel/issues/141/events","html_url":"https://github.com/iclab/centinel/issues/141","id":91870736,"number":141,"title":"Update tcpdump to split up pcap for each test","user":{"login":"ben-jones","id":5179103,"avatar_url":"https://avatars.githubusercontent.com/u/5179103?v=3","gravatar_id":"","url":"https://api.github.com/users/ben-jones","html_url":"https://github.com/ben-jones","followers_url":"https://api.github.com/users/ben-jones/followers","following_url":"https://api.github.com/users/ben-jones/following{/other_user}","gists_url":"https://api.github.com/users/ben-jones/gists{/gist_id}","starred_url":"https://api.github.com/users/ben-jones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ben-jones/subscriptions","organizations_url":"https://api.github.com/users/ben-jones/orgs","repos_url":"https://api.github.com/users/ben-jones/repos","events_url":"https://api.github.com/users/ben-jones/events{/privacy}","received_events_url":"https://api.github.com/users/ben-jones/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/iclab/centinel/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":{"login":"ben-jones","id":5179103,"avatar_url":"https://avatars.githubusercontent.com/u/5179103?v=3","gravatar_id":"","url":"https://api.github.com/users/ben-jones","html_url":"https://github.com/ben-jones","followers_url":"https://api.github.com/users/ben-jones/followers","following_url":"https://api.github.com/users/ben-jones/following{/other_user}","gists_url":"https://api.github.com/users/ben-jones/gists{/gist_id}","starred_url":"https://api.github.com/users/ben-jones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ben-jones/subscriptions","organizations_url":"https://api.github.com/users/ben-jones/orgs","repos_url":"https://api.github.com/users/ben-jones/repos","events_url":"https://api.github.com/users/ben-jones/events{/privacy}","received_events_url":"https://api.github.com/users/ben-jones/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/iclab/centinel/milestones/4","html_url":"https://github.com/iclab/centinel/milestones/Initial%20analysis%20code","labels_url":"https://api.github.com/repos/iclab/centinel/milestones/4/labels","id":1185784,"number":4,"title":"Initial analysis code","description":"We don't have any analysis code and we really need to change this. This milestone represents the minimum functionality necessary to start doing analysis and displaying results to users.","creator":{"login":"ben-jones","id":5179103,"avatar_url":"https://avatars.githubusercontent.com/u/5179103?v=3","gravatar_id":"","url":"https://api.github.com/users/ben-jones","html_url":"https://github.com/ben-jones","followers_url":"https://api.github.com/users/ben-jones/followers","following_url":"https://api.github.com/users/ben-jones/following{/other_user}","gists_url":"https://api.github.com/users/ben-jones/gists{/gist_id}","starred_url":"https://api.github.com/users/ben-jones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ben-jones/subscriptions","organizations_url":"https://api.github.com/users/ben-jones/orgs","repos_url":"https://api.github.com/users/ben-jones/repos","events_url":"https://api.github.com/users/ben-jones/events{/privacy}","received_events_url":"https://api.github.com/users/ben-jones/received_events","type":"User","site_admin":false},"open_issues":1,"closed_issues":0,"state":"open","created_at":"2015-06-29T18:12:36Z","updated_at":"2015-06-29T18:19:36Z","due_on":"2015-07-31T04:00:00Z","closed_at":null},"comments":10,"created_at":"2015-06-29T18:11:41Z","updated_at":"2015-07-06T22:42:20Z","closed_at":null,"body":"Currently, our script collects a single pcap for all of the tests in an experiment, creating a single enormous pcap that is difficult to analyze. We made the design decision to collect a single pcap of the entire experiment because 1) it let us drop root privileges for most of the experiment, 2) it let us cut out the time for starting and stopping tcpdump, and 3) there was no other way to capture traffic for the concurrent HTTP measurements. The concurrent HTTP sessions will generate traffic to multiple destinations and will be difficult to predict where the traffic will go for each connection (imagine following redirects to a blockpage). This means that we cannot pull traffic for each measurement after the experiment finishes, so we are stuck with a single pcap if we do concurrent HTTP measurements.\r\n\r\nAt the cost of speed, we should offer the option to get a pcap for each measurement (when doing serial, not concurrent measurements) by either a) stopping and starting tcpdump for each measurement or b) waiting a second between each measurement and segmenting the pcap based on time.\r\n"},"comment":{"url":"https://api.github.com/repos/iclab/centinel/issues/comments/119018290","html_url":"https://github.com/iclab/centinel/issues/141#issuecomment-119018290","issue_url":"https://api.github.com/repos/iclab/centinel/issues/141","id":119018290,"user":{"login":"rpanah","id":6577290,"avatar_url":"https://avatars.githubusercontent.com/u/6577290?v=3","gravatar_id":"","url":"https://api.github.com/users/rpanah","html_url":"https://github.com/rpanah","followers_url":"https://api.github.com/users/rpanah/followers","following_url":"https://api.github.com/users/rpanah/following{/other_user}","gists_url":"https://api.github.com/users/rpanah/gists{/gist_id}","starred_url":"https://api.github.com/users/rpanah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rpanah/subscriptions","organizations_url":"https://api.github.com/users/rpanah/orgs","repos_url":"https://api.github.com/users/rpanah/repos","events_url":"https://api.github.com/users/rpanah/events{/privacy}","received_events_url":"https://api.github.com/users/rpanah/received_events","type":"User","site_admin":false},"created_at":"2015-07-06T22:42:20Z","updated_at":"2015-07-06T22:42:20Z","body":"Also, this from @ben-jones (PR #124):\r\n\r\n> Concurrency shouldn't be an issue for us either at the collection or the analysis stage. If we assume that we are on RPIs, which we previously have, then we can safely collect all traffic to target ports without an risk of collecting user data. For example, we could collect all the data or just collect all of the packets destined for port 53 to get all DNS traffic. Additionally, concurrency won't be an issue at the analysis stage because a) bro is awesome for analyzing pcaps will give us a log of all of the DNS requests and responses in the pcap and b) it is really easy to correlate DNS requests and responses. DNS packets contain a query ID field that must match between the query and response and the responses often contain the original question, making identification even easier.\r\n\r\n> Basically, I don't see a strong argument for not using concurrency. If we have concurrency, then there is no reason to reduce the timeout."}}