QMDL v.s PCAP

[m0xsec]

Hello,

Looking for clarification regarding exporting QMDL and PCAPs - are the PCAPs just converted from the QMDL format or would using a tool like scat to convert QMDL to PCAP yield different and/or additional data?

Love this project, thank you for all the work on this!!

[m0xsec]

I used a pcap diff tool to compare the exported PCAP and the resulting PCAP by using scat to read the QMDL file. The file sizes are different, and the pcap diff tool noted some packet differences in one instance:

Reading file ..\rayhunter_captures\exported.pcap:
Found 627 packets

Reading file ..\rayhunter_captures\qmdl_scat.pcap:
Found 627 packets

Diffing packets: not seq ack, no ip id, no checksum, 

Found 38 different packets

Writing ..\rayhunter_captures\diff_e3.pcap

I tested using these tools:

• scat - https://github.com/fgsect/scat
• pcap-diff - https://github.com/isginf/pcap-diff

[psthi]

I just go into the web interface click the PCAP log link, download and open with WireShark without using SCAT.

[m0xsec]

yeah - I am mostly curious about any differences between the files. I see some differences when doing a diff so im wondering what the source of truth is

[m0xsec]

File size differences:

Bytes	File
61896	exported.pcap
59708	qmdl_scat.pcap

[m0xsec]

@wgreenberg Sorry for the tag - wanted your thoughts on this. I was thinking of opening an issue but not sure if it warrants one as this might just be a knowledge gap on my end

[oopsbagel]

Just seeing this now -- the pcap can be considered a strict superset of the information contained in the qmdl.

[m0xsec]

Thank you very much! 🙏

[wgreenberg]

ack, i missed the notification from your tag, sorry @m0xsec! my guess as to why scat's PCAPs are different is that they're possibly storing different data in the GSMTAP headers, though it's a little surprising that theirs is smaller than ours. does the diff file clarify what the difference is?