The tool said it wrote 48 packets. Only 44 were there

说明与用途

PcapSplitter 中的错误导致在重用 5‑tuple 时文件名冲突，导致数据截断。通过在冲突时添加后缀并添加测试来修复此问题。

问题

A custom PCAP splitter tool reported 48 packets but only 44 were actually written to disk, indicating file truncation or corruption during session reuse.

结果

The bug was caused by filename collision on TCP session reuse, leading to file truncation or corruption. A targeted patch added a collision suffix and tests, resolving the issue and preventing future data loss.

工作流

• 1. Observe mismatch between reported and actual packet count.
• 2. Reproduce with minimal 13‑connection test case.
• 3. Investigate theories: file descriptor exhaustion and hardcoded LRU limit – both ruled out.
• 4. Inspect FiveTupleSplitter::getFileNumber and getFileName logic – discover fileNumber is ignored for TCP/UDP paths.
• 5. Trace main.cpp writer cache – new fileNum opens file without append, truncating or racing with existing writer.
• 6. Identify root cause: identical filenames for reused 5‑tuples.
• 7. File issue on GitHub (#2248).
• 8. Propose fix: suffix filename only on collision, preserve original for first session.
• 9. Implement code change and unit tests.
• 10. Submit PR (#2249) and merge after maintainer approval.

证据

PcapSplitter reported 12 files and 48 packets, but on disk, there were 11 files and 44 packets.

来源

Because fileNumber is dropped, the new session produces the identical filename string as the older session.

来源

Merged #2249

来源