pcapr-local 0.1.10

data/test/mu/tc_pcap.rb

@@ -0,0 +1,39 @@
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+require 'mu/testcase'
+require 'mu/pcap'
+
+module Mu
+class Pcap
+
+class Test < Mu::TestCase
+    def test_basics
+        pcap = Pcap.new
+        pkthdr = Pkthdr.new
+        pkthdr.caplen = pkthdr.len = 77
+        ethernet = Ethernet.new
+        ethernet.src = '00:01:01:00:00:01'
+        ethernet.dst = '00:01:01:00:00:02'
+        ethernet.type = Ethernet::ETHERTYPE_IP
+        ethernet.payload = ethernet.payload_raw = 'X' * 73
+        pkthdr.pkt = ethernet
+        pcap.pkthdrs << pkthdr
+        
+        bytes = "\xa1\xb2\xc3\xd4" + "\x00\x02" +  "\x00\x04" +
+            "\x00\x00\x00\x00" + "\x00\x00\x00\x00" +
+            "\x00\x00\x05\xdc" + "\x00\x00\x00\x00" +
+            "\x00\x00\x00\x00" + "\x00\x00\x00\x00" + # pkthdr
+            "\x00\x00\x00\x4d" + "\x00\x00\x00\x4d" + 
+            "\x00\x00\x00\x02" + ("X" * 73)
+        pcap_in = nil
+        with_no_stderr do # supress warning about malformed IPv4
+            pcap_in = Pcap.read StringIO.new(bytes)
+        end
+        assert_equal pcap_in, pcap
+    end
+end
+
+end
+end

data/test/mu/testcase.rb

@@ -0,0 +1,86 @@
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+require 'tempfile'
+require 'test/unit'
+require 'pp' # Require to make pp available in tests
+
+
+module Mu
+class TestCase < ::Test::Unit::TestCase
+    def setup
+        self.reset
+    end
+
+    def self.reset
+        # Reset random number generator and Time.now to known values
+        srand 31337
+    end
+
+    def reset
+        self.class.reset
+    end
+
+    def assert_files_same expected_file, actual_file, message=nil
+        expected_file = File.expand_path expected_file
+        actual_file = File.expand_path actual_file
+
+        # Set TC_CREATE env variable to create missing stdout files
+        create_missing_file = ENV['TC_CREATE'].to_s.length > 0
+        # Set TC_UPDATE env variable to update stdout files instead of failing (be careful!)
+        bulk_update         = ENV['TC_UPDATE'].to_s.length > 0
+
+        if create_missing_file and not File.exists? expected_file
+            File.open("/dev/tty", 'w') do |tty| 
+                tty.puts "Warning: copying #{actual_file} to #{expected_file}"
+            end
+            File.open(expected_file, 'w') {|f| f.write File.read(actual_file)}
+        end
+
+        assert File.exists?(expected_file), "File #{expected_file.inspect} does not exist"
+        assert File.exists?(actual_file), "File #{actual_file.inspect} does not exist"
+
+        message ||= "Files differ: #{expected_file} #{actual_file}"
+        assert_block message do 
+            $stderr.puts `diff -ub #{expected_file} #{actual_file} 2>&1`
+            if $?.exitstatus == 0 
+                return true
+            end
+
+            # Hook for graphical diff/merge tools
+            if diff = ENV['DIFF']
+                puts `#{diff} #{expected_file} #{actual_file}`
+            else
+                $stderr.puts "You may want to rerun test with DIFF env variable set to a graphical diff/merge tool"
+            end
+
+            if bulk_update
+                File.open("/dev/tty", 'w') do |tty|
+                    tty.puts "Warning: updating expected output at #{actual_file} to #{expected_file}" 
+                end
+                File.open(expected_file, 'w') {|f| f.write File.read(actual_file)}
+                next true
+            end
+
+            false
+        end
+    end
+
+    # Suppress output to stderr.  For testing code that may log to stderr.
+    def with_no_stderr # block
+        begin
+            old_stderr = $stderr
+            $stderr = StringIO.new
+            yield
+        ensure
+            $stderr = old_stderr
+        end
+    end
+
+    def default_test
+        # Defining this method prevents this class from running and failing
+        # due to lack of tests.
+    end
+end
+end

data/test/pcapr_local/data.js

@@ -0,0 +1,3 @@
+{"status":"indexed","updated_at":"2010/12/22 01:30:20 +0000","_id":"6808db6ca2264c01780e7fb4fb5ca623","_rev":"3-a5530512f0c1010c7d82c7f1dda0d516","type":"pcap","index":{"about":{"packets":28,"hosts":10,"version":"4.5.41604","services":7,"flows":5,"duration":9.45506},"services":["browser","nbns","arp","sip","sip/sdp","rtp","icmp"]},"filename":"A1.pcap","stat":{"inode":6395143,"size":9300,"ctime":"2010/12/18 01:41:41 +0000"},"created_at":"2010/12/22 01:30:18 +0000"}
+{"status":"indexed","updated_at":"2010/12/22 01:30:23 +0000","_id":"6808db6ca2264c01780e7fb4fb5c9022","_rev":"3-1121a5eff55ba3d3c0b6e6177c5dcfcf","type":"pcap","index":{"about":{"packets":2,"hosts":3,"version":"4.5.41604","services":1,"flows":0,"duration":4.59072e-05},"services":["arp"]},"filename":"arp.pcap","stat":{"inode":6395176,"size":140,"ctime":"2010/12/20 18:56:49 +0000"},"created_at":"2010/12/22 01:30:18 +0000"}
+{"status":"indexed","updated_at":"2010/12/22 01:30:26 +0000","_id":"6808db6ca2264c01780e7fb4fb5c9ada","_rev":"3-8c43c559332f027de3b27ce59c54a41b","type":"pcap","index":{"about":{"packets":22,"hosts":5,"version":"4.5.41604","services":6,"flows":4,"duration":6.29398},"services":["arp","sip/sdp","sip","rtcp","rtp","icmp"]},"filename":"sip_signalled_call_1.pcap","stat":{"inode":6395187,"size":5039,"ctime":"2010/12/21 02:04:04 +0000"},"created_at":"2010/12/22 01:30:18 +0000"}

data/test/pcapr_local/tc_api.rb

@@ -0,0 +1,181 @@
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+$: << File.expand_path(File.dirname(__FILE__) + '../../../../lib')
+
+require 'pcapr_local'
+require 'test/unit'
+
+module CouchTest
+    def datafile
+        nil
+    end
+
+    # Returns user config but with parameters to changed to prevent clobbering user data.
+    def config
+        config = PcaprLocal::Config.config
+        config['couch']['database'] = "#{config['couch']['database']}_test"
+        config['install_dir'] = "/tmp/pcapr_local_test"
+        config['pcap_dir'] = "/tmp/pcapr_local_test/pcaps"
+        config['index_dir'] = "/tmp/pcapr_local_test/indexes"
+        config['app']['port'] = config['app']['port'].to_i + 1
+        config
+    end
+
+    # Starts pcapr_local in separate process
+    def setup
+        config = self.config
+        host = config['app']['host']
+        port = config['app']['port']
+        @url_base = "http://#{host}:#{port}"
+
+        # Extract test pcaps and indexes
+        FileUtils.rm_rf '/tmp/pcapr_local_test'
+        test_tar = File.join(File.expand_path(File.dirname(__FILE__)), 'test.tgz')
+        if File.exist? test_tar
+            puts `tar -C /tmp/ -xzf #{test_tar}`
+        end
+
+        # Recreate test database.
+        begin
+            couch = config['couch']
+            RestClient.delete "#{couch['uri']}/#{couch['database']}"
+        rescue RestClient::ResourceNotFound
+        end
+        db = PcaprLocal.get_db config
+
+        # And restore it from datafile.
+        if self.datafile
+            load_docs self.datafile, db
+        end
+
+        # Start server.
+        config_file = Tempfile.new "config"
+        config_file.print config.to_json
+        config_file.flush
+        @pid = fork do 
+            Process.setpgid $$, $$
+            exec "#{PcaprLocal::ROOT}/bin/startpcapr -f #{config_file.path} -d" 
+        end
+
+        # And wait for it to be ready.
+        wait_for_server host, port
+    end
+
+    def wait_for_server host, port, time=10
+        stop = Time.new + time
+        while Time.new < stop
+            if s = TCPSocket.open(host, port) rescue nil
+                s.close
+                return
+            end
+            sleep 0.01
+        end
+
+        raise "Server at #{host}:#{port} took longer than #{time} seconds to start"
+    end
+
+    def teardown
+        # stop server
+        if @pid
+            Process.kill -2, @pid 
+            Process.wait @pid
+            @pid = nil
+        end
+    end
+
+    def load_docs doc_file, db
+        open doc_file do |js|
+            while line = js.gets
+                doc = JSON.parse line
+                doc.delete '_rev'
+                db.save_doc doc, true
+            end
+
+            db.bulk_save
+        end
+    end
+
+    def assert_json s1, s2, msg=nil
+        o1 = JSON.parse s1
+        o2 = JSON.parse s2
+
+        if o1.is_a? Hash
+            o1.delete "_rev"
+        end
+
+        if o2.is_a? Hash
+            o2.delete "_rev"
+        end
+
+        assert_equal o1, o2, msg
+    end
+end
+
+class CouchTestBasic < Test::Unit::TestCase
+    include CouchTest
+
+    def datafile
+        File.join(File.dirname(__FILE__), 'data.js')
+    end
+
+    def test_basic
+        # Main page 
+        r = RestClient.get @url_base
+        assert_match "pcapr.Local", r
+
+        # Status
+        r = RestClient.get "#{@url_base}/pcaps/1/status"
+        assert_equal '{"indexed,1292981418000":3}', r
+
+        # Statistics
+        r = RestClient.get "#{@url_base}/pcaps/1/statistics"
+        assert_json '{"packets":52,"bytes":14479,"services":14,"flows":9,"pcaps":3}', r
+
+        # List
+        list = {
+            'date'      => %q{{"rows":[{"id":"6808db6ca2264c01780e7fb4fb5c9022","value":null,"key":1292981418000},{"id":"6808db6ca2264c01780e7fb4fb5c9ada","value":null,"key":1292981418000},{"id":"6808db6ca2264c01780e7fb4fb5ca623","value":null,"key":1292981418000}],"offset":0,"total_rows":3}},
+            'path'      => %q{{"rows":[{"value":3,"key":null}]}},
+            'status'    => %q{{"rows":[{"value":3,"key":null}]}},
+            'service'   => %q{{"rows":[{"value":14,"key":null}]}},
+            'keyword'   => %q{{"rows":[{"value":7,"key":null}]}},
+            'filename'  => %q{{"rows":[{"id":"6808db6ca2264c01780e7fb4fb5ca623","value":null,"key":"A1.pcap"},{"id":"6808db6ca2264c01780e7fb4fb5c9022","value":null,"key":"arp.pcap"},{"id":"6808db6ca2264c01780e7fb4fb5c9ada","value":null,"key":"sip_signalled_call_1.pcap"}],"offset":0,"total_rows":3}},
+            'directory' => %q{{"rows":[{"value":3,"key":null}]}}
+        }
+
+        r = RestClient.get "#{@url_base}/pcaps/1/list"
+        assert_json list['date'], r
+
+        list.keys.each do |key|
+            r = RestClient.get "#{@url_base}/pcaps/1/list?by=#{key}"
+            assert_json list[key], r, "unexpected result when listing by key '#{key}'"
+        end
+
+        # About
+        r = RestClient.get "#{@url_base}/pcaps/1/about/6808db6ca2264c01780e7fb4fb5c9ada"
+        assert_json %q{{"status":"indexed","updated_at":"2010/12/22 01:30:26 +0000","_id":"6808db6ca2264c01780e7fb4fb5c9ada","_rev":"1-2fcf4b207c34b4928bf08945a084a1e7","type":"pcap","filename":"sip_signalled_call_1.pcap","index":{"about":{"packets":22,"hosts":5,"version":"4.5.41604","services":6,"flows":4,"duration":6.29398},"services":["arp","sip/sdp","sip","rtcp","rtp","icmp"]},"stat":{"inode":6395187,"size":5039,"ctime":"2010/12/21 02:04:04 +0000"},"created_at":"2010/12/22 01:30:18 +0000"}}, r
+
+        # Remove
+        r = RestClient.get "#{@url_base}/pcaps/1/remove/6808db6ca2264c01780e7fb4fb5c9ada"
+        assert_json %q{{"error":true,"reason":"status is not failed"}}, r
+
+        # Explore on pcapr
+        r = RestClient.get "#{@url_base}/pcaps/1/pcap/6808db6ca2264c01780e7fb4fb5c9ada"
+        assert_match /pcapr/, r, "Doesn't look like we got redirected to pcapr"
+
+        # Forward to xtractr API
+        r = RestClient.get "#{@url_base}/pcaps/1/pcap/6808db6ca2264c01780e7fb4fb5c9ada/api/fields"
+        assert_equal %q{["pkt.src","pkt.dst","pkt.flow","pkt.id","pkt.pcap","pkt.first","pkt.dir","pkt.time","pkt.offset","pkt.length","pkt.service","pkt.title","arp.dst.hw.mac","arp.hw.size","arp.hw.type","arp.isgratuitous","arp.opcode","arp.proto.size","arp.proto.type","arp.src.hw.mac","eth.addr","eth.dst","eth.ig","eth.lg","eth.src","eth.type","icmp.code","icmp.type","ip.dsfield","ip.dsfield.ce","ip.dsfield.dscp","ip.dsfield.ect","ip.dst.host","ip.flags","ip.flags.df","ip.flags.mf","ip.flags.rb","ip.frag.offset","ip.hdr.len","ip.host","ip.id","ip.len","ip.proto","ip.src.host","ip.ttl","ip.version","rtcp.length","rtcp.length.check","rtcp.padding","rtcp.pt","rtcp.rc","rtcp.sc","rtcp.sdes.length","rtcp.sdes.text","rtcp.sdes.type","rtcp.sender.octetcount","rtcp.sender.packetcount","rtcp.senderssrc","rtcp.setup.frame","rtcp.setup.method","rtcp.ssrc.cum.nr","rtcp.ssrc.dlsr","rtcp.ssrc.ext.high","rtcp.ssrc.fraction","rtcp.ssrc.high.cycles","rtcp.ssrc.high.seq","rtcp.ssrc.identifier","rtcp.ssrc.jitter","rtcp.ssrc.lsr","rtcp.timestamp.ntp","rtcp.timestamp.ntp.lsw","rtcp.timestamp.ntp.msw","rtcp.timestamp.rtp","rtcp.version","rtp.cc","rtp.ext","rtp.extseq","rtp.marker","rtp.p.type","rtp.padding","rtp.seq","rtp.setup.frame","rtp.setup.method","rtp.ssrc","rtp.timestamp","rtp.version","sdp.connection.info","sdp.connection.info.address","sdp.connection.info.address.type","sdp.fmtp.parameter","sdp.media","sdp.media.attr","sdp.media.attribute.field","sdp.media.attribute.value","sdp.media.format","sdp.media.media","sdp.media.port","sdp.media.proto","sdp.mime.type","sdp.owner","sdp.owner.address","sdp.owner.address.type","sdp.owner.sessionid","sdp.owner.username","sdp.owner.version","sdp.sample.rate","sdp.session.name","sdp.time","sdp.time.start","sdp.time.stop","sdp.version","sip.allow","sip.call.id","sip.contact","sip.content.length","sip.content.type","sip.cseq","sip.cseq.method","sip.cseq.seq","sip.from.addr","sip.from.host","sip.from.user","sip.max.forwards","sip.method","sip.msg.hdr","sip.r.uri","sip.r.uri.host","sip.r.uri.user","sip.release.time","sip.request.line","sip.resend","sip.response.request","sip.response.time","sip.server","sip.status.code","sip.status.line","sip.supported","sip.tag","sip.to","sip.to.addr","sip.to.host","sip.to.user","sip.user.agent","sip.via","udp.dstport","udp.length","udp.port","udp.srcport"]}, r
+        
+        # Export to zip
+        zip = RestClient.get "#{@url_base}/pcaps/1/export_to_par/6808db6ca2264c01780e7fb4fb5c9ada"
+        Tempfile.open 'zip' do |io| 
+            io.write zip
+            io.flush
+            unzip = `unzip -l #{io.path} |awk '{print $4}'`
+            assert_equal "\nName\n----\nabout\npdml\npsml\nfields\npackets.dump\nnormalized.pcap\n\n\n", unzip
+        end
+
+    end
+end

data/test/pcapr_local/test_scanner.rb

@@ -0,0 +1,241 @@
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+require 'mu/testcase'
+require 'pcapr_local'
+require 'test/pcapr_local/testcase'
+
+module PcaprLocal
+class Scanner
+
+class Test < ::PcaprLocal::Test::TestCase
+
+    class FakeXtractr
+        def index pcap_path, index_dir
+            FileUtils.mkdir_p "#{index_dir}/terms.db"
+            FileUtils.touch "#{index_dir}/packets.db"
+            FileUtils.touch "#{index_dir}/terms.db/segments"
+            FileUtils.touch "#{index_dir}/terms.db/segments_0"
+            return { "fake summary" => 'blah, blah, blah' }
+        end
+    end
+
+    PCAP = File.expand_path File.join(File.dirname(__FILE__), "arp.pcap")
+
+    def test_find_pcaps
+        do_setup
+
+        xtractr = FakeXtractr.new 
+        config = {
+           "db" => @db, 
+           "xtractr" => xtractr, 
+           "index_dir" => @index_dir, 
+           "pcap_dir" => @pcap_dir,
+           "queue_delay" => 0,
+           "interval" => 0,
+        }
+        scanner = Scanner.new config
+
+        # No pcaps
+        expected = Set.new
+        assert_equal Set.new, scanner.find_pcaps
+
+        # One pcap
+        FileUtils.cp PCAP, "#{@pcap_dir}/foo.pcap"
+        expected << 'foo.pcap'
+        assert_equal expected, scanner.find_pcaps
+
+        # Another
+        FileUtils.cp PCAP, "#{@pcap_dir}/bar.cap"
+        expected << 'bar.cap'
+        assert_equal expected, scanner.find_pcaps
+
+        # Ignore files that don't end in ".pcap" or ".cap"
+        FileUtils.cp PCAP, "#{@pcap_dir}/mypcap"
+        assert_equal expected, scanner.find_pcaps
+
+        # Should Find pcap in sub directory.
+        FileUtils.mkdir_p "#{@pcap_dir}/a/b/c/d"
+        assert_equal expected, scanner.find_pcaps
+        FileUtils.cp PCAP, "#{@pcap_dir}/a/b/c/d/foo.pcap"
+        expected << "a/b/c/d/foo.pcap"
+        assert_equal expected, scanner.find_pcaps
+
+        # Should not look into dir whose name begins with a "."
+        FileUtils.mkdir_p "#{@pcap_dir}/a/b/c/.d"
+        assert_equal expected, scanner.find_pcaps
+        FileUtils.cp PCAP, "#{@pcap_dir}/a/b/c/.d/foo.pcap"
+        assert_equal expected, scanner.find_pcaps
+
+        # Should handle subdir not searchable.
+        system "chmod a-r #{@pcap_dir}/a/b"
+        expected.delete "a/b/c/d/foo.pcap"
+        assert_equal expected, scanner.find_pcaps
+        system "chmod a+r #{@pcap_dir}/a/b"
+        expected << "a/b/c/d/foo.pcap"
+
+        # Should handle dir not searchable.
+        system "chmod  a-rx #{@pcap_dir}"
+        assert_equal Set.new, scanner.find_pcaps
+        system "chmod  a+rx #{@pcap_dir}"
+
+        # Should handle dir not searchable.
+        system "chmod  a-x #{@pcap_dir}"
+        assert_equal Set.new, scanner.find_pcaps
+        system "chmod  a+x #{@pcap_dir}"
+
+        # Should handle dir not searchable.
+        system "chmod  a-r #{@pcap_dir}"
+        assert_equal Set.new, scanner.find_pcaps
+        system "chmod  a+r #{@pcap_dir}"
+
+        # Should return empty set if directory is missing.
+        dir = "/tmp/test#{rand}#{$$}"
+        config['pcap_dir'] = dir
+        scanner = Scanner.new config
+        expected = Set.new
+        assert_equal expected, scanner.find_pcaps
+
+        # Should return empty set if directory is not searchable
+        assert_equal expected, scanner.find_pcaps
+        dir = "/tmp/test#{rand}#{$$}"
+        config['pcap_dir'] = dir
+        scanner = Scanner.new config
+        expected = Set.new
+        assert_equal expected, scanner.find_pcaps
+    ensure
+        system "chmod -R a+rx #{@pcap_dir}"
+    end
+
+    def test_remove_index_for
+        do_setup
+
+        config = {
+            "index_dir" => @index_dir,
+            "reaper_interval" => 60,
+            "idle_timeout" => 60,
+        }
+        xtractr = Xtractr.new config
+
+        config = {
+           "db" => @db, 
+           "xtractr" => xtractr, 
+           "index_dir" => @index_dir, 
+           "pcap_dir" => @pcap_dir,
+           "queue_delay" => 0,
+           "interval" => 0,
+        }
+        scanner = Scanner.new config
+
+        FileUtils.cp PCAP, "#{@pcap_dir}/foo.pcap"
+
+        # Create index
+        index_data = xtractr.index "#{@pcap_dir}/foo.pcap", "#{@index_dir}/foo.pcap"
+        assert File.directory? "#{@index_dir}/foo.pcap"
+        # Remove it
+        scanner.remove_index_for "foo.pcap"
+        assert_equal false, File.exist?("#{@index_dir}/foo.pcap")
+
+        # Create index with extra file, index should not be removed.
+        index_data = xtractr.index "#{@pcap_dir}/foo.pcap", "#{@index_dir}/foo.pcap"
+        FileUtils.touch "#{@index_dir}/foo.pcap/extra_file"
+        assert File.directory? "#{@index_dir}/foo.pcap"
+        scanner.remove_index_for "foo.pcap"
+        assert File.directory? "#{@index_dir}/foo.pcap"
+        FileUtils.rm_rf "#{@index_dir}/foo.pcap"
+    end
+
+    def test_basics
+        do_setup
+
+        xtractr = FakeXtractr.new 
+        config = {
+           "db" => @db, 
+           "xtractr" => xtractr, 
+           "index_dir" => @index_dir, 
+           "pcap_dir" => @pcap_dir,
+           "queue_delay" => 0,
+           "interval" => 0,
+        }
+        scanner = Scanner.new config
+        expected = ['.', '..']
+
+        # No pcaps, No indexes
+        scanner.scan
+        assert_equal expected.sort, Dir.entries(@index_dir).sort
+
+        # One pcap added.  Create one index.
+        FileUtils.cp PCAP, "#{@pcap_dir}/foo.pcap"
+        scanner.scan
+        expected << "foo.pcap"
+        assert_equal expected.sort, Dir.entries(@index_dir).sort
+
+        # Two additional pcaps. Should have 3 indexes.
+        FileUtils.cp PCAP, "#{@pcap_dir}/bar.pcap"
+        FileUtils.cp PCAP, "#{@pcap_dir}/baz.pcap"
+        expected << "bar.pcap"
+        expected << "baz.pcap"
+        scanner.scan
+        assert_equal expected.sort, Dir.entries(@index_dir).sort
+
+        # Delete an index, It should be recreated.
+        FileUtils.rm_r "#{@index_dir}/bar.pcap"
+        expected.delete "bar.pcap"
+        assert_equal expected.sort, Dir.entries(@index_dir).sort 
+        scanner.scan
+        expected << "bar.pcap"
+        assert_equal expected.sort, Dir.entries(@index_dir).sort
+
+        # Remove pcap, index should be removed.
+        File.unlink "#{@pcap_dir}/baz.pcap"
+        expected.delete "baz.pcap"
+        scanner.scan
+        scanner.scan
+        assert_equal expected.sort, Dir.entries(@index_dir).sort
+
+        # Scanner should find pcaps in subdirectory
+        FileUtils.mkdir_p "#{@pcap_dir}/a/b/c/d/"
+        FileUtils.cp PCAP, "#{@pcap_dir}/a/b/c/d/nested.pcap"
+        scanner.scan
+        expected << "a"
+        assert_equal expected.sort, Dir.entries(@index_dir).sort
+        assert File.exist? "#{@index_dir}/a/b/c/d/nested.pcap/terms.db"
+
+        # Pcap should not be indexed until its modification time is older 
+        # than queue_delay seconds.
+        delay_sec = 2
+        config['queue_delay'] = delay_sec
+        scanner = Scanner.new config
+        FileUtils.cp PCAP, "#{@pcap_dir}/new.pcap"
+        scanner.scan  
+        assert_equal expected.sort, Dir.entries(@index_dir).sort
+        sleep delay_sec + 1
+        scanner.scan
+        expected << "new.pcap"
+        assert_equal expected.sort, Dir.entries(@index_dir).sort
+
+        # Check that database has expected pcaps. 
+        expected = [
+            {"id"=>"0dddee3f87f14f1621e5744d667a95b7", "value"=>nil, "key"=>"a/b/c/d/nested.pcap"}, 
+            {"id"=>"6fc1ee4334c5564563c717bf7ccd734b", "value"=>nil, "key"=>"bar.pcap"}, 
+            {"id"=>"291eddbc4e2a539e6df74b141ea434f0", "value"=>nil, "key"=>"foo.pcap"}, 
+            {"id"=>"2517876b6c06c5fdcd4745a14ca96491", "value"=>nil, "key"=>"new.pcap"} 
+        ]
+        by_filename = []
+        @db.each_in_view 'pcaps/by_filename' do |row|
+            by_filename << row
+        end
+        by_filename.sort_by {|h| h['key']}
+        assert_equal expected, by_filename
+
+        # Check that all pcaps are indexed. 
+        @db.each_in_view 'pcaps/by_filename' do |row| 
+            doc = @db.get row["id"] 
+            assert_equal "indexed", doc.fetch("status")
+        end
+    end
+end
+
+end
+end