mirror of
https://github.com/morluto/rea
synced 2026-10-27 14:42:18 -04:00
Quentin Limo
9581e067ad
Summarize saved Wireshark4.x captures with enforced native resource limits, serialized admission, stable snapshot verification and retained fact/text pages. Preserve complete inventories within resource budgets and source uncertainty; report cleanup failure with partial Evidence and retained ownership. Verified six recorded corpora /13026 packets with independent Scapy/Python oracles, real CLI/MCP/schema parity,60 SNI names,132 DNS addresses and1000 URIs. Real TShark CI now exercises summary/paging. Actual Windows/Bun Wireshark remains unverified; macOS capture requires a separate enforceable-bound decision. Co-authored-by: 3QL <85309073+3QL@users.noreply.github.com> Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
18 lines
1.0 KiB
Batchfile
18 lines
1.0 KiB
Batchfile
@echo off
|
|
rem Pcap tool stub for Windows: emulates tshark --version and field output.
|
|
rem %1 is the first argument; the capture path arrives as %2 for -r/-c.
|
|
|
|
if "%~1"=="--version" (
|
|
echo TShark ^(Wireshark^) 4.6.6-windows-stub
|
|
exit /b 0
|
|
)
|
|
|
|
if not "%~1"=="-n" exit /b 2
|
|
if not "%~2"=="-r" exit /b 2
|
|
if not "%~4"=="-T" exit /b 2
|
|
if not "%~5"=="json" exit /b 2
|
|
|
|
rem Emit the same JSON as the POSIX stub
|
|
echo [{"_source":{"layers":{"frame.number":["1"],"frame.protocols":["eth:ethertype:ip:udp:dns"],"ip.src":["192.168.1.100"],"ip.dst":["8.8.8.8"],"dns.qry.name":["api.example.com"],"dns.flags.response":["1"],"dns.a":["93.184.216.34"]}}},{"_source":{"layers":{"frame.number":["2"],"frame.protocols":["eth:ethertype:ip:tcp:tls"],"ip.src":["192.168.1.100"],"ip.dst":["93.184.216.34"],"tls.handshake.extensions_server_name":["api.example.com"]}}},{"_source":{"layers":{"frame.number":["3"],"frame.protocols":["eth:ethertype:ip:tcp:http"],"ip.src":["192.168.1.100"],"ip.dst":["93.184.216.34"],"http.request.full_uri":["http://api.example.com/v1/data"]}}}]
|
|
exit /b 0
|