Project

General

Profile

Bug #9239

WebGUI: Diagnostics > Packet Capture will try to display any size of pcap file.

Added by Steve Wheeler 5 months ago. Updated 11 days ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Web Interface
Target version:
Start date:
12/31/2018
Due date:
% Done:

100%

Estimated time:
Affected Version:
2.4.x
Affected Architecture:
All

Description

The diag_packet_capture.php p[age will try to display any size of pcap when the capture is stopped regardless of how large it is.

This can result it either long load times and an unmanageably large page or at larger sizes it exhausts the available php memory for a single page:

Crash report begins.  Anonymous machine information:

amd64
11.2-RELEASE-p4
FreeBSD 11.2-RELEASE-p4 #2 b00c407ba5d(RELENG_2_4_4): Mon Nov 26 11:41:48 EST 2018     root@buildbot2.nyi.netgate.com:/build/ce-crossbuild-244/obj/amd64/ZfGpH5cd/build/ce-crossbuild-244/pfSense/tmp/FreeBSD-src/sys/pfSense

Crash report details:

PHP Errors:
[27-Dec-2018 19:35:43 America/Toronto] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 532692992 bytes) in /usr/local/www/diag_packet_capture.php on line 541
[27-Dec-2018 19:35:43 America/Toronto] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 532676888 bytes) in Unknown on line 0

No FreeBSD crash data found.

However it is still possible to download the capture when this happens.

It would be nice to see it show just a message explaining why it's not showing the capture. Or maybe a new detail level of 'None' so you have to deliberately choose 'Normal' to attempt to display it. That could apply to any capture over, for example, 5000 packets.

Associated revisions

Revision 36192f4a (diff)
Added by Jim Pingle 4 months ago

Packet capture page fixes. Fixes #9239

  • Add "None" output level
  • Detect large files and refuse to print them in the GUI textarea
  • Ensure output buffering is off before doing readfile to avoid PHP
    consuming memory while downloading a large capture.

Revision 0b07930d (diff)
Added by Jim Pingle 4 months ago

Packet capture page fixes. Fixes #9239

  • Add "None" output level
  • Detect large files and refuse to print them in the GUI textarea
  • Ensure output buffering is off before doing readfile to avoid PHP
    consuming memory while downloading a large capture.

(cherry picked from commit 36192f4a459ec5d5baf06819102ba783c1725ba1)

History

#1 Updated by Jim Pingle 5 months ago

  • Assignee set to Jim Pingle
  • Target version set to 48

Either or both of those should be fairly simple to do..

#2 Updated by Flole Systems 5 months ago

Even when downloading a too large capture it will fail..... (it just has to be large enough).

#3 Updated by Jim Pingle 4 months ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 100

#4 Updated by Vladimir Lind 4 months ago

tested on 2.4.5-DEVELOPMENT (arm)
built on Fri Jan 25 05:46:46 EST 2019

Invoked a lot of traffic while running pcap with unlimited packet count. Got message when stopped pcap in 30 min:

Packet capture file is too large to display in the GUI.
Download the file, or view it in the console or ssh shell.

pcap file 1.8G was available for downloading

Looks good.

#5 Updated by James Dekker 4 months ago

On 2.4.5.a.20190201.0810, tested with an iperf3 traffic stream running over WAN with a simultaneous packet capture on the same interface for about 5 minutes at about 700-800 Mbps. When the packet capture was stopped,

Packet capture file is too large to display in the GUI.
Download the file, or view it in the console or ssh shell.

appeared in the Packets Captured box. Clicked Download Capture button and the resulting multi-gigabyte capture file downloaded without issue.

#6 Updated by James Dekker 4 months ago

  • Status changed from Feedback to Resolved

#7 Updated by Jim Pingle 2 months ago

  • Target version changed from 48 to 2.5.0

#8 Updated by Jim Pingle 14 days ago

  • Target version changed from 2.5.0 to 2.4.4-p3

#9 Updated by Jim Pingle 14 days ago

  • Status changed from Resolved to Feedback

#10 Updated by Chris Linstruth 12 days ago

Looks good.

Packet capture file is too large to display in the GUI.
Download the file, or view it in the console or ssh shell.

Downloaded 2XXMB capture file without issue.

#11 Updated by Jim Pingle 11 days ago

  • Status changed from Feedback to Resolved

Also available in: Atom PDF