This issue is not always reproducible.
Sometimes router_raw.pcap is missing packets. More often it is missing the last packets which is the reason I added this delay:
|
self.log.info("Wait for 30 seconds to let tcpdump and mitmdump flush logs on disk...") |
Without the delay we might have a totally empty pcap.
Another example. In the following pcap we must see two HTTP requests and responses:
CVE-2024-9796.zip
But for the second one we only see the response:
HTTP/1.1 200 OK
Date: Tue, 19 Nov 2024 09:11:12 GMT
Server: Apache/2.4.52 (Ubuntu)
Content-Length: 48
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
HamsterAdmin
$P$BlFivphqBYpRhfApFIGIul7BuM2elG1
Can this be a tcpdump issue? I'd suggest trying it out with wireshark.
This issue is not always reproducible.
Sometimes router_raw.pcap is missing packets. More often it is missing the last packets which is the reason I added this delay:
CVEX/src/cvex/routervm.py
Line 70 in a5cbca4
Without the delay we might have a totally empty pcap.
Another example. In the following pcap we must see two HTTP requests and responses:
CVE-2024-9796.zip
But for the second one we only see the response:
Can this be a tcpdump issue? I'd suggest trying it out with wireshark.