mapreduce - pcap to Avro on Hadoop -
i need know if there way can convert pcap file avro , can write map reduce program on avro data using hadoop ?
otherwise best practice when dealing pcap files on hadoop ?
thanks
a pcap file collection of records, each containing time stamp, packet length field, "amount of data packet captured , saved" length field, , unstructured blob of raw packet data.
the avro documentation says:
avro provides:
- rich data structures.
....
"unstructured blob of raw packet data" , "rich data structures" don't go together; you'll have parse raw packet data, same way implementations of protocols in packet , same way tcpdump/wireshark/various other protocol analyzers do, turn structured data, can have data on can do processing.
so, first, need figure out you're trying here. sort of analysis want do? packet data want process? packet time stamps? source , destination ip addresses? protocols within packet? in particular protocol?
very nice post,thank you for your info..
ReplyDelete