vanken 0.1.0 → 0.2.0

data/lib/vanken/app/document_analysis.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Vanken
+  module App
+    module DocumentAnalysis
+      def self.included(base) = base.extend(ClassMethods)
+
+      module ClassMethods
+        def recover(directory, **options)
+          store = Core::FrameStore.recover(directory)
+          new(store: store, **options).analyze_store
+        rescue StandardError
+          store&.close(remove: false)
+          raise
+        end
+      end
+
+      def analyze_store
+        @source ||= :live
+        @dirty = @source == :live unless @rebuilding
+        @received, @analyzed, @cancelled = true, false, false
+        @analyzer = @process_analysis ? Capture::AnalyzerProcess.new(self, verify_checksums: @verify_checksums) : Capture::Analyzer.new(self, @dissector)
+        @jobs << thread { @analyzer.run }
+        self
+      end
+
+      def reanalyze(decode_as: @analysis_gateway_options[:decode_as], plugins: @analysis_gateway_options[:plugins], preferences: nil)
+        raise Vanken::Error, "stop capture or finish loading before changing analysis" if loading? || closing?
+        options = @analysis_gateway_options.merge(decode_as: decode_as, plugins: plugins).freeze
+        options = options.merge(verify_checksums: preferences.get("analysis.verify_checksums")).freeze if preferences
+        dissector = Gateway::Dissector.new(**options)
+        snapshot = @mutex.synchronize { reanalysis_snapshot }
+        cancel_search if respond_to?(:cancel_search)
+        cancel_scan
+        wait(3)
+        @mutex.synchronize do
+          @analysis_gateway_options, @dissector = options, dissector
+          @verify_checksums = options[:verify_checksums]
+          if preferences
+            @analysis_options = {max_state_bytes: preferences.get("analysis.max_state_mib") << 20, max_flows: preferences.get("analysis.max_flows")}.freeze
+            @scan_concurrency = preferences.get("analysis.workers")
+            @cache = Core::RowCache.new(limit: preferences.get("packet_list.row_cache_rows"))
+          end
+          @columns = Core::ColumnStore.new
+          @annotations.close
+          @annotations = Core::AnnotationStore.new(@store.directory)
+          @cache.clear
+          @catalog = Gateway::FieldCatalog.new(registry: @dissector.registry)
+          @count, @display, @error = 0, (@filter ? [] : nil), nil
+          @rebuilding = true
+          @reanalysis_cancelled = false
+          @rebuilding_filter_basis = @filter_basis
+          @filter_context = @reanalysis_context = snapshot
+          [@details, @detail_reader, @detail_index, @summaries, @summary_index, @summary_reader, @summary_index_reader].each(&:close)
+          open_analysis_files
+        end
+        analyze_store
+      end
+
+      private
+
+      def open_analysis_files
+        @details = File.open(File.join(@store.directory, "details.jsonl"), "w+b", 0o600)
+        @detail_reader = File.open(File.join(@store.directory, "details.jsonl"), "rb")
+        @detail_index = File.open(File.join(@store.directory, "reassembled.idx"), "w+b", 0o600)
+        @detail_offsets = {}
+        @summaries = File.open(File.join(@store.directory, "summaries.bin"), "w+b", 0o600)
+        @summary_index = File.open(File.join(@store.directory, "summaries.idx"), "w+b", 0o600)
+        @summary_reader = File.open(File.join(@store.directory, "summaries.bin"), "rb")
+        @summary_index_reader = File.open(File.join(@store.directory, "summaries.idx"), "rb")
+        @summary_count = 0
+      end
+    end
+  end
+end

data/lib/vanken/app/document_jobs.rb

@@ -9,7 +9,8 @@ module Vanken
         cancel_scan
         if expression.empty?
           @mutex.synchronize do
-            @filter = @filter_context = @display = @progress = @filter_job = nil
+            @filter = @filter_context = @filter_basis = @display = @progress = @filter_job = nil
+            @filter_live_predecessors = @filter_live_predecessor_start = nil
           end
           notify(force: true)
           return self
@@ -18,6 +19,9 @@ module Vanken
           context = filter_snapshot(displayed_delta: program.fields.include?("frame.time_delta_displayed"))
           @filter = program
           @filter_context = context
+          @filter_basis = context
+          @filter_live_predecessors = program.fields.include?("frame.time_delta_displayed") ? "".b : nil
+          @filter_live_predecessor_start = @filter_live_predecessors ? @count + 1 : nil
           # Reserve the history's capacity before publishing matches without placeholder rows.
           @display = Array.new(@count)
           @display[0, @count] = []
@@ -88,6 +92,7 @@ module Vanken
       end
 
       def cancel_scan
+        cancel_search
         tasks = @mutex.synchronize do
           @generation += 1
           @progress = nil
@@ -109,7 +114,7 @@ module Vanken
         end
         predecessors = (first...last).to_h { |number| [number.to_s, displayed_predecessor(number, snapshot)] }
         {"spool" => @store.directory, "expr" => expression, "from" => first, "to" => last,
-         "decode_as" => [], "plugins" => [], "annotations_json" => snapshot[:annotations_json],
+         "decode_as" => @analysis_gateway_options[:decode_as], "plugins" => @analysis_gateway_options[:plugins], "annotations_json" => snapshot[:annotations_json],
          "marked" => snapshot[:marked].select { |number| number >= first && number < last },
          "ignored" => snapshot[:ignored].select { |number| number >= first && number < last },
          "time_references_ns" => snapshot[:references].to_h { |number| [number.to_s, @store.metadata(number)[:timestamp_ns]] },
@@ -118,13 +123,19 @@ module Vanken
       end
 
       def displayed_predecessor(number, snapshot)
+        if (packed = snapshot[:live_predecessors]) && number >= snapshot[:live_predecessor_start]
+          offset = (number - snapshot[:live_predecessor_start]) * 8
+          return packed.unpack1("Q<", offset: offset) if offset < packed.bytesize
+        end
         return number - 1 unless snapshot[:predecessors]
         return snapshot[:last_displayed] || 0 if number > snapshot[:limit]
         snapshot[:predecessors].fetch(number, 0)
       end
 
       def sort(key, direction = :asc)
+        cancel_search
         raise ArgumentError, "invalid sort direction" unless %i[asc desc].include?(direction)
+        custom_field = custom_columns.find { |item| item["key"] == key.to_s }&.fetch("field")
         generation, sort_generation, filter_job = @mutex.synchronize do
           @sort_generation = (@sort_generation || 0) + 1
           [@generation, @sort_generation, @filter_job]
@@ -134,11 +145,15 @@ module Vanken
           next if generation != @generation || sort_generation != @sort_generation || @closing
           numbers = display_numbers
           values = numbers.to_h do |number|
-            value = case key.to_sym
-            when :no, :number then number
-            when :time then @store.metadata(number)[:timestamp_ns]
-            when :length then @store.metadata(number)[:original_length]
-            else row(number).fetch(key.to_sym)
+            value = if custom_field
+              custom_sort_value(number, custom_field)
+            else
+              case key.to_sym
+              when :no, :number then number
+              when :time then @store.metadata(number)[:timestamp_ns]
+              when :length then @store.metadata(number)[:original_length]
+              else row(number).fetch(key.to_sym)
+              end
             end
             [number, value]
           end
@@ -155,7 +170,7 @@ module Vanken
       def save(path, format: nil, numbers: nil)
         @error = nil
         format ||= File.extname(path) == ".pcap" ? :pcap : :pcapng
-        limit = count
+        limit = @store.durable_count
         @save_job = thread do
           temporary = Tempfile.create([".vanken-", ".tmp"], File.dirname(File.expand_path(path)))
           begin
@@ -168,7 +183,8 @@ module Vanken
             temporary.close
             File.rename(temporary.path, File.expand_path(path))
             @mutex.synchronize do
-              @dirty = false if !numbers && @count == limit && @store.count == limit
+              @saved_count = limit unless numbers
+              @dirty = false if !numbers && @store.count == limit
               @path = File.expand_path(path) unless numbers
             end
             notify(force: true)
@@ -188,6 +204,33 @@ module Vanken
 
       private
       def stale_job?(generation) = @closing || generation != @generation
+      # Retain only post-filter arrivals, at eight bytes per packet, and only for
+      # displayed-delta filters. Rebuilds read this basis without replacing it.
+      def record_live_predecessors(first, last, matches, context: @filter_context)
+        return unless @filter_live_predecessors
+        return if @rebuilding && @filter_basis.equal?(@rebuilding_filter_basis)
+        previous = (@display ? @display.last : @count) || 0
+        cursor = 0
+        (first..last).each do |number|
+          if number >= @filter_live_predecessor_start
+            raise Vanken::Error, "nonsequential displayed-delta history" unless number == @filter_live_predecessor_start + (@filter_live_predecessors.bytesize / 8)
+            predecessor = context ? displayed_predecessor(number, context) : previous
+            @filter_live_predecessors << [predecessor].pack("Q<")
+          end
+          if matches[cursor] == number
+            previous = number
+            cursor += 1
+          end
+        end
+      end
+
+      def reanalysis_snapshot
+        basis = @filter_basis || filter_snapshot(displayed_delta: !!@filter&.fields&.include?("frame.time_delta_displayed"))
+        return basis unless @filter_live_predecessors
+        basis.merge(live_predecessors: @filter_live_predecessors.dup.freeze,
+          live_predecessor_start: @filter_live_predecessor_start, limit: @count).freeze
+      end
+
       def filter_snapshot(displayed_delta: true)
         predecessors = @display.each_with_index.to_h { |number, index| [number, index.zero? ? 0 : @display[index - 1]] }.freeze if displayed_delta && @display
         {marked: @marked.dup.freeze, ignored: @ignored.dup.freeze, references: @time_references.dup.freeze,

data/lib/vanken/app/expert_info.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Vanken
+  module App
+    ExpertRow = Data.define(:severity, :code, :protocol, :message, :count, :numbers)
+
+    module ExpertInfo
+      def self.rows(document, displayed_only: false)
+        displayed = document.display_numbers.to_set if displayed_only
+        groups = {}
+        document.annotations.experts.dup.each do |number, items|
+          next if displayed && !displayed.include?(number)
+          items.each do |item|
+            key = [Gateway::Severity.normalize(item[:severity]), item[:code], item[:protocol]]
+            group = (groups[key] ||= {message: item[:message], count: 0, numbers: []})
+            group[:count] += 1
+            group[:numbers] << number unless group[:numbers].last == number
+          end
+        end
+        groups.map do |(severity, code, protocol), value|
+          ExpertRow.new(severity: severity, code: code, protocol: protocol, **value.merge(numbers: value[:numbers].freeze))
+        end.sort_by { |row| [-Gateway::Severity.rank(row.severity), row.protocol, row.code] }
+      end
+    end
+  end
+end

data/lib/vanken/app/io_graph.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require_relative "../core/display_filter/compiler"
+
+module Vanken
+  module App
+    IOPoint = Data.define(:interval, :start_ns, :packets, :bytes)
+    IOSeries = Data.define(:expression, :interval_ns, :points, :omitted_intervals)
+
+    module IOGraph
+      INTERVALS = [0.01, 0.1, 1, 10, 60].freeze
+
+      def self.build(document, interval: 1, series: [""], displayed_only: false, cancelled: nil)
+        raise ArgumentError, "invalid I/O interval" unless INTERVALS.include?(interval)
+        raise ArgumentError, "I/O graph needs 1-64 series" unless series.size.between?(1, 64) && series.all? { |expression| expression.is_a?(String) }
+        interval_ns = (interval * 1_000_000_000).to_i
+        programs = series.map { |expression| Core::DisplayFilter.compile(expression, catalog: document.catalog) }
+        numbers = displayed_only ? document.display_numbers : (1..document.count)
+        start = document.count.zero? ? 0 : document.store.metadata(1)[:timestamp_ns]
+        bins = series.map { {} }
+        last = 0
+        numbers.each do |number|
+          raise Vanken::Error, "operation cancelled" if document.closing? || cancelled&.call
+          metadata = document.store.metadata(number)
+          index = [(metadata[:timestamp_ns] - start) / interval_ns, 0].max
+          last = [last, index].max
+          view = nil
+          programs.each_with_index do |program, position|
+            next unless series[position].empty? || program.match?(view ||= document.view(number))
+            row = (bins[position][index] ||= [0, 0])
+            row[0] += 1
+            row[1] += metadata[:original_length]
+          end
+        end
+        # ponytail: retain at most 100,000 intervals; coarsen the selected interval for longer captures.
+        first = [last - 99_999, 0].max
+        series.each_with_index.map do |expression, position|
+          points = (document.count.zero? ? [] : (first..last)).map do |index|
+            packets, bytes = bins[position].fetch(index, [0, 0])
+            IOPoint.new(interval: index, start_ns: start + (index * interval_ns), packets: packets, bytes: bytes)
+          end
+          IOSeries.new(expression: expression, interval_ns: interval_ns, points: points.freeze, omitted_intervals: first)
+        end
+      end
+    end
+  end
+end

data/lib/vanken/app/navigation.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require_relative "search_job"
+
+module Vanken
+  module App
+    module Navigation
+      def displayed_index(number)
+        @mutex.synchronize { @display ? @display.index(number) : (number.is_a?(Integer) && number.between?(1, @count) ? number - 1 : nil) }
+      end
+
+      def toggle_mark(number) = toggle_packet_state(@marked, number, "frame.marked")
+      def toggle_ignore(number) = toggle_packet_state(@ignored, number, "frame.ignored")
+      def toggle_time_reference(number) = toggle_packet_state(@time_references, number, "frame.time_relative")
+      def mark_all_displayed
+        @mutex.synchronize { @marked.merge(@display || (1..@count)) }
+        packet_states_changed("frame.marked")
+        self
+      end
+      def unmark_all
+        @mutex.synchronize { @marked.clear }
+        packet_states_changed("frame.marked")
+        self
+      end
+
+      def conversation_neighbor(number, direction)
+        return nil unless number.is_a?(Integer) && [1, -1].include?(direction)
+        @mutex.synchronize do
+          return nil unless number.between?(1, @count)
+          stream = @annotations[number][:tcp_stream]
+          return nil if stream.negative?
+          numbers = @annotations.streams.fetch(stream, [])
+          index = numbers.bsearch_index { |item| item >= number } || numbers.size
+          index += direction
+          while index.between?(0, numbers.size - 1)
+            candidate = numbers[index]
+            return candidate unless @display && !@display.include?(candidate)
+            index += direction
+          end
+          nil
+        end
+      end
+
+      def search(query, **options, &finished)
+        cancel_search
+        job = SearchJob.new(self, query, **options)
+        @search_job = job
+        snapshot = @mutex.synchronize { filter_snapshot(displayed_delta: !!job.program&.fields&.include?("frame.time_delta_displayed")) }
+        @jobs << thread do
+          hit = job.run(snapshot: snapshot)
+          finished&.call(hit, nil) unless job.cancelled?
+        rescue StandardError => error
+          finished&.call(nil, error) unless job.cancelled?
+        end
+        job
+      end
+      def cancel_search
+        @search_job&.cancel
+        @search_job = nil
+        self
+      end
+
+      private
+      def toggle_packet_state(values, number, field)
+        @mutex.synchronize do
+          raise Vanken::Error, "invalid packet number" unless number.is_a?(Integer) && number.between?(1, @count)
+          values.include?(number) ? values.delete(number) : values.add(number)
+        end
+        packet_states_changed(field)
+        self
+      end
+      def packet_states_changed(field)
+        @filter && @filter.fields.include?(field) ? apply_filter(@filter.expression) : notify(force: true)
+      end
+    end
+  end
+end

data/lib/vanken/app/search_job.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require_relative "../core/display_filter/compiler"
+
+module Vanken
+  module App
+    class SearchJob
+      attr_reader :program
+      def initialize(document, query, mode: :filter, target: :bytes, from: nil, direction: 1)
+        @document, @mode, @target, @from = document, mode.to_sym, target.to_sym, from
+        raise Vanken::Error, "invalid search mode or target" unless %i[filter hex string regex].include?(@mode) && %i[list details bytes].include?(@target)
+        raise Vanken::Error, "search query is empty" if query.empty?
+        raise Vanken::Error, "invalid search direction" unless [1, -1].include?(direction)
+        @direction = direction
+        @program = Core::DisplayFilter.compile(query, catalog: document.catalog) if @mode == :filter
+        @query = if @mode == :hex
+          hex = query.delete(" \t\r\n:")
+          raise Vanken::Error, "16 進数は 2 桁ずつ入力してください" unless /\A(?:[\da-fA-F]{2})+\z/.match?(hex)
+          [hex].pack("H*")
+        elsif @mode == :regex
+          Regexp.new(@target == :bytes ? query.b : query, timeout: 0.1)
+        else
+          query.dup
+        end
+      rescue RegexpError => error
+        raise Vanken::Error, "invalid search pattern: #{error.message}"
+      end
+
+      def cancel = @cancelled = true
+      def cancelled? = @cancelled || @document.closing?
+      def run(snapshot: nil)
+        limit = @document.displayed_count
+        return nil if limit.zero?
+        origin = @document.displayed_index(@from) || (@direction.positive? ? -1 : limit)
+        1.upto(limit) do |step|
+          return nil if cancelled?
+          number = @document.number_at((origin + (step * @direction)) % limit)
+          matched = if @mode == :filter
+            @program.match?(@document.view(number, snapshot: snapshot))
+          else
+            text = search_text(number)
+            @mode == :regex ? @query.match?(text) : text.b.include?(@query.b)
+          end
+          return number if matched && !cancelled?
+          Thread.pass if step % 256 == 0
+        end
+        nil
+      rescue Regexp::TimeoutError
+        raise Vanken::Error, "検索の正規表現が時間制限を超えました"
+      end
+
+      private
+      def search_text(number)
+        case @target
+        when :bytes then @document.store.read(number).bytes
+        when :list then @document.row(number).values.join("\t")
+        when :details then @document.details(number).flat_map(&:descendants).map(&:label).join("\n")
+        end
+      end
+    end
+  end
+end

data/lib/vanken/app/stats_job.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require_relative "../gateway/statistics"
+
+module Vanken
+  module App
+    # Invoke refresh on the executor; cancel joins its current frame before store close.
+    class StatsJob
+      def initialize(document, specs: ["phs"], displayed_only: false)
+        @document, @specs, @displayed_only = document, specs, displayed_only
+        @mutex, @numbers, @cancelled = Mutex.new, [], false
+        reset
+      end
+
+      def refresh
+        @mutex.synchronize do
+          return [] if @cancelled || @document.closing?
+          numbers = @displayed_only ? @document.display_numbers.sort : (1..@document.count).to_a
+          reset unless numbers.take(@numbers.size) == @numbers
+          numbers.drop(@numbers.size).each do |number|
+            break if @cancelled || @document.closing?
+            @statistics.update(@dissector.dissect(@document.store.read(number)))
+            @numbers << number
+          end
+          @statistics.tables
+        end
+      end
+
+      def cancel
+        @cancelled = true
+        @mutex.synchronize { @statistics.close }
+        self
+      end
+
+      private
+
+      def reset
+        @statistics&.close
+        @numbers = []
+        @dissector = Gateway::Dissector.new(**@document.analysis_gateway_options)
+        @statistics = Gateway::Statistics.new(specs: @specs, registry: @dissector.registry, **@document.analysis_options)
+      end
+    end
+  end
+end

data/lib/vanken/capture/analyzer.rb

@@ -11,7 +11,7 @@ module Vanken
       def run
         number = 1
         loop do
-          break if @document.respond_to?(:closing?) && @document.closing?
+          break if @document.analysis_stopped?
           if number > @document.store.durable_count
             break if @document.received? && number > @document.store.durable_count
             @document.wait_for_frames
@@ -20,11 +20,13 @@ module Vanken
           frame = @document.store.read(number)
           begin
             packet = @dissector.dissect(frame)
+            break if @document.analysis_stopped?
             @analysis.update(packet)
           rescue StandardError => error
             @document.publish_failure(number, error)
             packet = nil
           end
+          break if @document.analysis_stopped?
           @document.publish(number, packet) if packet
           number += 1
           if number % 256 == 0

data/lib/vanken/capture/analyzer_process.rb

@@ -11,6 +11,7 @@ module Vanken
         @document, @verify_checksums = document, verify_checksums
       end
       def run
+        return if @document.analysis_stopped?
         unless Gem.win_platform?
           raise Vanken::Error, "packet analysis must run without root privileges" if Process.uid.zero? || Process.euid.zero?
         end
@@ -23,10 +24,11 @@ module Vanken
         @pid = Process.spawn(*arguments, in: child_in, out: child_out, close_others: true)
         child_in.close
         child_out.close
-        request(command: :start, spool: @document.store.directory, verify_checksums: @verify_checksums, analysis_options: @document.analysis_options)
+        request(command: :start, spool: @document.store.directory, verify_checksums: @verify_checksums, analysis_options: @document.analysis_options,
+          gateway_options: @document.analysis_gateway_options)
         number = 1
         loop do
-          break if @document.closing?
+          break if @document.analysis_stopped?
           limit = @document.store.durable_count
           if number > limit
             break if @document.received? && number > @document.store.durable_count
@@ -36,13 +38,14 @@ module Vanken
           last = [number + 255, limit].min
           configuration = @document.analysis_configuration(number, last)
           batch = request(configuration.merge(command: :analyze, first: number, last: last, interfaces: @document.store.interfaces))
+          break if @document.analysis_stopped?
           raise Vanken::Error, "analysis response range mismatch" unless batch[:first] == number && batch[:last] == last
           @document.publish_analysis_batch(batch, self, configuration[:generation], context_token: configuration[:context_token])
           number = last + 1
         end
       rescue StandardError
-        @document.cancel
-        raise unless @document.closing?
+        @document.cancel unless @document.analysis_stopped?
+        raise unless @document.analysis_stopped?
       ensure
         child_in&.close unless child_in&.closed?
         child_out&.close unless child_out&.closed?
@@ -54,7 +57,7 @@ module Vanken
       end
       def request(value)
         AnalyzerWire.write(@input, value)
-        response = AnalyzerWire.read(@output, cancelled: -> { @document.closing? })
+        response = AnalyzerWire.read(@output, cancelled: -> { @document.analysis_stopped? })
         raise Vanken::Error, response[:error] if response[:error]
         response
       end
@@ -82,7 +85,7 @@ module Vanken
           end
           sleep(0.005)
         end
-        raise Vanken::Error, "analysis worker failed while stopping" unless status.success? || @document.closing? || $!
+        raise Vanken::Error, "analysis worker failed while stopping" unless status.success? || @document.analysis_stopped? || $!
       rescue Errno::ECHILD, Errno::ESRCH
         nil
       end

data/lib/vanken/capture/analyzer_worker.rb

@@ -57,11 +57,11 @@ module Vanken
 
       def initialize(request)
         @reader = Reader.new(request.fetch(:spool))
-        @dissector = Gateway::Dissector.new(verify_checksums: request.fetch(:verify_checksums))
+        @dissector = Gateway::Dissector.new(**request.fetch(:gateway_options, {verify_checksums: request.fetch(:verify_checksums)}))
         @analysis = Gateway::Analysis.new(registry: @dissector.registry, **request.fetch(:analysis_options))
         @columns = Core::ColumnStore.new
         @annotations = Core::AnnotationStore.new(request.fetch(:spool), persist: false)
-        @catalog = Gateway::FieldCatalog.new
+        @catalog = Gateway::FieldCatalog.new(registry: @dissector.registry)
         @seen_fields = @catalog.names.to_set
         @context = Context.new(@reader)
         @next = 1

data/lib/vanken/capture/filter_worker.rb

@@ -8,6 +8,7 @@ require_relative "../core/frame_store"
 require_relative "../core/stores"
 require_relative "../core/display_filter/compiler"
 require_relative "../gateway/dissector"
+require_relative "../gateway/display_capture_filter"
 
 module Vanken
   module Capture
@@ -153,12 +154,17 @@ module Vanken
         raise ArgumentError, "filter chunk exceeds stored frames" unless last <= reader.count + 1
 
         dissector = Gateway::Dissector.new(decode_as: payload.fetch("decode_as", []), plugins: payload.fetch("plugins", []))
-        program = Core::DisplayFilter.compile(payload.fetch("expr"), catalog: Gateway::FieldCatalog.new)
+        program = Core::DisplayFilter.compile(payload.fetch("expr"), catalog: Gateway::FieldCatalog.new(registry: dissector.registry))
+        capture = Gateway::DisplayCaptureFilter.new(payload.fetch("expr")) if payload.fetch("plugins", []).empty? && payload.fetch("decode_as", []).empty?
+        capture = nil unless capture&.expression
         context = {marked: Set.new(payload.fetch("marked", [])), ignored: Set.new(payload.fetch("ignored", [])),
                    reference: payload.fetch("time_reference_ns") { reader.count.zero? ? 0 : reader.metadata(1)[:timestamp_ns] },
                    references: payload.fetch("time_references_ns", {}).map { |number, timestamp| [Integer(number), timestamp] }.sort_by(&:first),
                    predecessors: payload.fetch("displayed_predecessors", {})}
-        matches = (first...last).select { |number| program.match?(View.new(reader, number, dissector, context)) }
+        matches = (first...last).select do |number|
+          matched = capture&.match(reader.frame(number))
+          matched.nil? ? program.match?(View.new(reader, number, dissector, context)) : matched
+        end
         {"matches" => matches}
       ensure
         reader&.close

data/lib/vanken/capture/helper_main.rb

@@ -23,7 +23,7 @@ module Vanken
         when :list_interfaces then @stdout.puts(JSON.generate(Gateway::Interfaces.list)); return 0
         when :check then return check(options)
         when :version then @stdout.puts("Vanken #{VERSION}"); return 0
-        when :help then @stdout.puts("vanken-capture -i INTERFACE [--filter EXPR] [--snaplen N] [--no-promiscuous]\n  [--buffer-size BYTES] [--direction in|out|inout] [--backend auto|ring|socket|bpf]\n  [--drop-to UID:GID] [--stats-interval SEC] [--flush-interval SEC]\n  --list-interfaces | --check [--interface IF] | --version"); return 0
+        when :help then @stdout.puts("vanken-capture -i INTERFACE [--filter EXPR] [--snaplen N] [--no-promiscuous]\n  [--buffer-size BYTES] [--direction in|out|inout] [--backend auto|ring|socket|bpf]\n  [--drop-to UID:GID] [--stats-interval SEC] [--flush-interval SEC]\n  [--stop-count N] [--stop-duration SEC] [--stop-bytes BYTES]\n  --list-interfaces | --check [--interface IF] | --version"); return 0
         end
 
         capture(options)
@@ -64,11 +64,18 @@ module Vanken
         end
         @control.write(:started, interface: options.capture[:interface], linktype: source.linktype,
                        snaplen: options.capture[:snaplen], backend: source.backend, filter: options.capture[:filter], privileges_dropped: dropped)
-        flushed_at = stats_at = monotonic
+        started_at = flushed_at = stats_at = monotonic
+        captured = 0
         until @stop_reason || source.stopped?
           packet = source.next_packet(timeout: 0.05)
-          writer << packet if packet
+          if packet
+            writer << packet
+            captured += 1
+          end
           now = monotonic
+          @stop_reason ||= "count_limit" if options.stop_count && captured >= options.stop_count
+          @stop_reason ||= "duration_limit" if options.stop_duration && now - started_at >= options.stop_duration
+          @stop_reason ||= "bytes_limit" if options.stop_bytes && writer.bytes_written >= options.stop_bytes
           if now - flushed_at >= options.flush_interval
             writer.flush
             flushed_at = now

data/lib/vanken/capture/helper_options.rb

@@ -5,7 +5,8 @@ require "optparse"
 module Vanken
   module Capture
     class HelperOptions
-      attr_reader :command, :capture, :drop_to, :stats_interval, :flush_interval
+      attr_reader :command, :capture, :drop_to, :stats_interval, :flush_interval,
+                  :stop_count, :stop_duration, :stop_bytes
 
       def self.parse(argv)
         new.parse(argv)
@@ -36,13 +37,16 @@ module Vanken
           end
           opts.on("--stats-interval SEC", Float) { |v| @stats_interval = bounded(v, 0.01..60, "stats-interval") }
           opts.on("--flush-interval SEC", Float) { |v| @flush_interval = bounded(v, 0.001..1, "flush-interval") }
+          opts.on("--stop-count N", Integer) { |v| @stop_count = bounded(v, 1..9_223_372_036_854_775_807, "stop-count") }
+          opts.on("--stop-duration SEC", Float) { |v| @stop_duration = bounded(v, 0.001..31_536_000, "stop-duration") }
+          opts.on("--stop-bytes N", Integer) { |v| @stop_bytes = bounded(v, 1..9_223_372_036_854_775_807, "stop-bytes") }
           opts.on("--list-interfaces") { modes << :list_interfaces }
           opts.on("--check") { modes << :check }
           opts.on("--version") { modes << :version }
           opts.on("-h", "--help") { modes << :help }
         end
         # OptionParser accepts long-option abbreviations by default; privileged inputs must be exact.
-        known = %w[--interface --filter --snaplen --no-promiscuous --buffer-size --direction --backend --drop-to --stats-interval --flush-interval --list-interfaces --check --version --help]
+        known = %w[--interface --filter --snaplen --no-promiscuous --buffer-size --direction --backend --drop-to --stats-interval --flush-interval --stop-count --stop-duration --stop-bytes --list-interfaces --check --version --help]
         argv.each do |arg|
           raise ArgumentError, "unknown option: #{arg}" if arg.start_with?("--") && !known.include?(arg.split("=", 2).first)
         end

data/lib/vanken/capture/launcher.rb

@@ -171,6 +171,7 @@ module Vanken
       def capture_argv(options)
         options.flat_map do |key, value|
           next [] if value.nil?
+          next [] if %i[stop_count stop_duration stop_bytes].include?(key.to_sym) && value == 0
           next value ? [] : ["--no-promiscuous"] if key.to_sym == :promiscuous
 
           ["--#{key.to_s.tr('_', '-')}", value.to_s]