Show HN: Tcpkit – A tool to analyze TCP/UDP packets with Lua | Hacker News Reader

Show HN: Tcpkit – A tool to analyze TCP/UDP packets with Lua

github.com

65 pointsgit-hulk10 comments

How does this differ from scapy other than lua vs python?

tcpkit offer embedded Redis/Memcached/DNS latency monitor, and export latency's data to the user, you can store it to influxdb and show latency buckets with grafana. we now use tcpkit to offer redis/memcached latency monitor.

Any reason to use this over Wireshark/tshark + Lua?

I haven't used this yet but...

It seems like wireshark doesn't directly have filters for latency. I end up adding the column when in the gui version of wireshark but this is a pretty nice cli version.

yeah, and tcpkit also can run on the server side and exports the stats info to the user. User can store stats into influxdb or others db.

tcpkit can run on the server side or client side and exports the stats to the user by TCP port

I have an embedded system, I have C and Lua and size is a major issue. This really looks interesting to me, maybe I can fit it, and then run have custom Lua parsers for different protocols.

Libpcap is probably the biggest issue, it’s pretty large in our world.

I had a quick look through tcpkit, it seems to make some odd decisions. For example latency stats is done in C. Why isn’t this a generic Lua plugin? I want latency, but the buckets are all wrong in my world, my latency starts at 300ms, and increases. Why isn’t this in Lua and easily tweakable.

Plus, is I can do latency stats then I can start doing some really interesting things I care about. For example bandwidth use, average packet size, etc etc.

(Oh, and why Lua 5.2? 5.3 has ints, which is nice when dealing with numbers)

tcpkit allow the user to run have custom Lua parsers for different protocols. and the latency only works in redis/memcached mode, use `-m` to specify the mode, the default is raw, and the packet would pass to Lua VM. See the example in scripts dir. I would update the Lua to 5.3 later, or pr is welcome.

I'm actually pretty excited by this. I hope you didn't take my comment negatively, this is something that I might really be able to use.

aha, I very appreciate your comment, also the suggestions were great.

Reply on news.ycombinator.com