4 ms·
I've been looking to use mitmproxy to capture traffic in a project, but the serialization format is something called TNetStrings [1], which postfixes types and
by sanqui 5y ago
I've been looking to use mitmproxy to capture traffic in a project, but the serialization format is something called TNetStrings [1], which postfixes types and is thus not streamable. There seem to be some efforts to switch flow captures to use SQLite [2] or Protobuf [3], although PCAP would also be nice, I think.
[1] https://tnetstrings.info/ https://tnetstrings.info/
[2] https://github.com/mitmproxy/mitmproxy/issues/3075 https://github.com/mitmproxy/mitmproxy/issues/3075
[3] https://github.com/mitmproxy/mitmproxy/pull/3232 https://github.com/mitmproxy/mitmproxy/pull/3232
- ireneu 5y agoThere’s an addon that supports PCAP files [0]. It works quite well in my experience. [0] https://github.com/muzuiget/mitmpcap https://github.com/muzuiget/mitmpcap
- mhils 5y agoCould you explain what your use case is? What format would you prefer?
- deleted 5y ago[deleted]
- sanqui 5y agoSorry for not stating that in the first place! My use case is archival and preservation. It should be possible to stream the format, build indexes into it (ideally at runtime alongside the capture), it should be as complete as possible, and it should last a long time. I'm looking into pcapng together with a sslkeylog file as the formats of choice for this currently.