Skip to content

Traffic duplication removal (CIC-IDS-2017)#4

Open
lisa-lthorrold wants to merge 1 commit intoGintsEngelen:mainfrom
lisa-lt:main
Open

Traffic duplication removal (CIC-IDS-2017)#4
lisa-lthorrold wants to merge 1 commit intoGintsEngelen:mainfrom
lisa-lt:main

Conversation

@lisa-lthorrold
Copy link
Copy Markdown

This is a more refined version of the previously closed pull request by @mlavin. #1

The main improvement over the previous script is a reduction unintended consequences of applying editcap packet deduplication over the entire pcap. This is done by isolating the impacted mac addresses and ip addresses that have been confirmed to have definite duplication by prior analysis.

@Paippi
Copy link
Copy Markdown

Paippi commented Nov 13, 2024

The wait in this code doesn't work as intended. Culprit being the remove_traffic_duplication.sh:47, which spawns a subshell causing the while loop to be performed in another process, thus leading to parent process not waiting for the process to finish.

More info here: https://mywiki.wooledge.org/BashFAQ/024
and here: https://stackoverflow.com/a/63489913/17897224

One way to fix this is to use a for loop instead.

# <---snip--->
    # Find pcap files
    for line in $(find "$1" -iname "*.pcap")
    do
# <---snip--->

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants