[nycbug-talk] pcs issues

[George Neville-Neil]

On Jun 21, 2012, at 15:36 , Nikolai Fetissov wrote:

>> All
>> I was testing out some of the examples from the pcs talk last month,
>> and I am running into some errors. I wanted to see if anyone could
>> shed some light on this.
>> 
>> Here is what I did
>> 
>> 
>> root at nymirror1:/usr/local/share/examples/pcs # python ddos_analyze.py
>> -f /usr/local/pcap-logs/26-nybweb1.pcap -m 25 -s 255.255.255.0 -n
>> 10.12.13.0
>> Traceback (most recent call last):
>>  File "ddos_analyze.py", line 105, in <module>
>>    main()
>>  File "ddos_analyze.py", line 87, in main
>>    if (ip.src & mask) != network:
>>  File "/usr/local/lib/python2.7/site-packages/pcs/__init__.py", line
>> 1061, in __getattribute__
>>    return object.__getattribute__(self, name)
>> AttributeError: 'arp' object has no attribute 'src'
>> 
>> 
>> I am using python 2.7.3,  I had the same results with 2.6.6,  on
>> FreeBSD 9-STABLE amd64 .
>> 
>> 
>> The pcap file was created this way
>> 
>> tcpdump -i igb1 -s 1500 -w /usr/local/pcap-logs/26-nybweb1.pcap
>> 
> 
> Restict the capture with "proto ip"?

Yup, that works, or you can do hack the code to ignore anything not ip:

if type(packet.data) != ipv4:
	continue

Since these are all objects you can do object type comparisons.

Best,
George