Merge pull request #16 from travelping/snaplength-feature

Added snaplength-feature (-s tshark parameter), specified base image as alpine:3.9.

Author: KilianDargel

Diff for: CHANGELOG.md

@@ -1,6 +1,15 @@
+## v1.2.0- Feature:
+
+- Added snaplength feature
+- Specified base image as alpine:3.9
+
 ## v1.1.0- Feature:
 
-- Added formatting option
+- Reworked (experimental) formatting option
+
+## v1.0.2- (Experimental) Feature:
+
+- Added (experimental) formatting option
 
 ## v1.0.1
 

Diff for: Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine
+FROM alpine:3.9
 
 RUN apk add --no-cache tshark coreutils
 
@@ -10,6 +10,7 @@ ENV MAXFILESIZE="1000"
 ENV MAXFILENUM="10"
 ENV FILENAME="dump"
 ENV FORMAT="pcapng"
+ENV SNAPLENGTH=""
 
 USER root:root
 

Diff for: README.md

@@ -1,7 +1,7 @@
 # TSHARK in a container
 
-This container starts a tshark and safes the captured packages in files. It 
-uses a ring buffer with a default file size of 1 Gigabyte and a maximum number 
+This container starts a tshark and safes the captured packages in files. It
+uses a ring buffer with a default file size of 1 Gigabyte and a maximum number
 of files of 10. All files are stored in the `/data` directory.
 
 ## Usage
@@ -23,6 +23,7 @@ These options are configurable:
 | `DURATION`    |          `""` |
 | `FILENAME`    |        `dump` |
 | `FORMAT`      |      `pcapng` |
+| `SNAPLENGTH`  | <deactivated> |
 
 `IFACE` space-separated list of interfaces tshark should listen on.
 
@@ -34,22 +35,26 @@ be opened. The unit for this is Megabytes (1 Megabyte = 1,000,000 bytes).
 `MAXFILENUM` is the maximum number of files that are opened before tshark
 starts overwriting old files one by one beginning with the first one.
 
-`DURATION` is the maximum number of seconds tshark waits until it begins to 
+`DURATION` is the maximum number of seconds tshark waits until it begins to
 write into the next file.
 
-The `FILENAME` variable sets the filename that is used. The default value is 
-`dump`. A number will be attached to each file (see tshark manpage for more 
-information). To dump on multiple interfaces simply add more interfaces to this 
+The `FILENAME` variable sets the filename that is used. The default value is
+`dump`. A number will be attached to each file (see tshark manpage for more
+information). To dump on multiple interfaces simply add more interfaces to this
 variable seperated by a whitespace (e.g. "eth0 eth1").
 
 `FORMAT` sets the file-format of the written trace. Note that when you're setting
 the `FORMAT` to `pcap` for example, the `FILENAME` has to be changed to `dump.pcap`.
 Other formats are described in the [official tshark documentation](https://www.wireshark.org/docs/man-pages/tshark.html).
 
+`SNAPLENGTH` is the amount of data for each frame that is actually captured by the
+network capturing tool and stored into the CaptureFile. This is sometimes called PacketSlicing.
+By default this is turned off so large packets are not truncated by accident.
+
 Example:
 
 ```
--> % ls -1 dump 
+-> % ls -1 dump
 dump_00164_20180622110637
 dump_00165_20180622110638
 dump_00166_20180622110639
@@ -73,13 +78,13 @@ option to read captured raw packages from a file.
 
 ### Display Filters
 
-Since `tshark` does not allow for wireshark like filters to be applied to a 
-capture stream. And the functionality of piping to a `tshark` and than applying 
-a read filter is also broken (see 
-https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234), applying wireshark 
+Since `tshark` does not allow for wireshark like filters to be applied to a
+capture stream. And the functionality of piping to a `tshark` and than applying
+a read filter is also broken (see
+https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234), applying wireshark
 like filters needs to be done in a second filter pass.
 
-This can be done with a local installed instance of `tshark` or using the 
+This can be done with a local installed instance of `tshark` or using the
 `tshark` provided by the docker-pcap container:
 
 ```

Diff for: run.sh

@@ -35,4 +35,9 @@ then
   BUFFEROPTS="$BUFFEROPTS -b duration:$DURATION"
 fi
 
-/usr/bin/tshark $BUFFEROPTS -w "/data/$FILENAME" -f "$FILTER" $INTERFACES -F $FORMAT
+if [ -n "$SNAPLENGTH" ];
+then
+  SNAPLENGTH="-s $SNAPLENGTH"
+fi
+
+/usr/bin/tshark $BUFFEROPTS -w "/data/$FILENAME" -f "$FILTER" $INTERFACES -F $FORMAT $SNAPLENGTH