mapreduce - pcap to Avro on Hadoop -


i need know if there way can convert pcap file avro , can write map reduce program on avro data using hadoop ?

otherwise best practice when dealing pcap files on hadoop ?

thanks

a pcap file collection of records, each containing time stamp, packet length field, "amount of data packet captured , saved" length field, , unstructured blob of raw packet data.

the avro documentation says:

avro provides:

  • rich data structures.

....

"unstructured blob of raw packet data" , "rich data structures" don't go together; you'll have parse raw packet data, same way implementations of protocols in packet , same way tcpdump/wireshark/various other protocol analyzers do, turn structured data, can have data on can do processing.

so, first, need figure out you're trying here. sort of analysis want do? packet data want process? packet time stamps? source , destination ip addresses? protocols within packet? in particular protocol?


Comments

Post a Comment

Popular posts from this blog

Magento/PHP - Get phones on all members in a customer group -

php - .htaccess mod_rewrite for dynamic url which has domain names -

Website Login Issue developed in magento -