Project

General

Profile

Actions

Bug #9239

closed

WebGUI: Diagnostics > Packet Capture will try to display any size of pcap file.

Added by Steve Wheeler about 5 years ago. Updated almost 5 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Web Interface
Target version:
Start date:
12/31/2018
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.4.x
Affected Architecture:
All

Description

The diag_packet_capture.php p[age will try to display any size of pcap when the capture is stopped regardless of how large it is.

This can result it either long load times and an unmanageably large page or at larger sizes it exhausts the available php memory for a single page:

Crash report begins.  Anonymous machine information:

amd64
11.2-RELEASE-p4
FreeBSD 11.2-RELEASE-p4 #2 b00c407ba5d(RELENG_2_4_4): Mon Nov 26 11:41:48 EST 2018     root@buildbot2.nyi.netgate.com:/build/ce-crossbuild-244/obj/amd64/ZfGpH5cd/build/ce-crossbuild-244/pfSense/tmp/FreeBSD-src/sys/pfSense

Crash report details:

PHP Errors:
[27-Dec-2018 19:35:43 America/Toronto] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 532692992 bytes) in /usr/local/www/diag_packet_capture.php on line 541
[27-Dec-2018 19:35:43 America/Toronto] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 532676888 bytes) in Unknown on line 0

No FreeBSD crash data found.

However it is still possible to download the capture when this happens.

It would be nice to see it show just a message explaining why it's not showing the capture. Or maybe a new detail level of 'None' so you have to deliberately choose 'Normal' to attempt to display it. That could apply to any capture over, for example, 5000 packets.

Actions #1

Updated by Jim Pingle about 5 years ago

  • Assignee set to Jim Pingle
  • Target version set to 48

Either or both of those should be fairly simple to do..

Actions #2

Updated by Flole Systems about 5 years ago

Even when downloading a too large capture it will fail..... (it just has to be large enough).

Actions #3

Updated by Jim Pingle about 5 years ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 100
Actions #4

Updated by Vladimir Lind about 5 years ago

tested on 2.4.5-DEVELOPMENT (arm)
built on Fri Jan 25 05:46:46 EST 2019

Invoked a lot of traffic while running pcap with unlimited packet count. Got message when stopped pcap in 30 min:

Packet capture file is too large to display in the GUI.
Download the file, or view it in the console or ssh shell.

pcap file 1.8G was available for downloading

Looks good.

Actions #5

Updated by Anonymous about 5 years ago

On 2.4.5.a.20190201.0810, tested with an iperf3 traffic stream running over WAN with a simultaneous packet capture on the same interface for about 5 minutes at about 700-800 Mbps. When the packet capture was stopped,

Packet capture file is too large to display in the GUI.
Download the file, or view it in the console or ssh shell.

appeared in the Packets Captured box. Clicked Download Capture button and the resulting multi-gigabyte capture file downloaded without issue.

Actions #6

Updated by Anonymous about 5 years ago

  • Status changed from Feedback to Resolved
Actions #7

Updated by Jim Pingle about 5 years ago

  • Target version changed from 48 to 2.5.0
Actions #8

Updated by Jim Pingle almost 5 years ago

  • Target version changed from 2.5.0 to 2.4.4-p3
Actions #9

Updated by Jim Pingle almost 5 years ago

  • Status changed from Resolved to Feedback
Actions #10

Updated by Chris Linstruth almost 5 years ago

Looks good.

Packet capture file is too large to display in the GUI.
Download the file, or view it in the console or ssh shell.

Downloaded 2XXMB capture file without issue.

Actions #11

Updated by Jim Pingle almost 5 years ago

  • Status changed from Feedback to Resolved
Actions

Also available in: Atom PDF