CICFlowMeter doesn`t work when the input file over 1GB

[mark12138]

when i use a *.pacp file over 1GB as CICFlowMeter`s input , it only gives 263 flows .

How can i solve this problem?

[aouinizied]

@mark12138 CicFlowMeter do not handle large files and have some memory issues. Did you try NFStream as an alternative processing tool?

[mark12138]

@mark12138 CicFlowMeter do not handle large files and have some memory issues. Did you try NFStream as an alternative processing tool?

I will try , Thanks a lot.

[meriemferdjouni]

@mark12138 CicFlowMeter do not handle large files and have some memory issues. Did you try NFStream as an alternative processing tool?

Hi @aouinizied, how many flow features the NFStream can extract?

Thank you.

[aouinizied]

88 features which include also nDPI based labels. Moreover, you can extend it easily with Plugins as described here: https://www.nfstream.org/docs/api#nfplugin

[benholden09]

Is there any way to use NFstream to produce data in the same format as the CIC-IDS2017 data set format?

[lion10]

@aouinizied I split the pcap files into smaller using editcap tool, and the CICFlowMeter works fine, but I am not sure if is it a good way to split the pcap file or not. what do you think? Thank you

[abmnyuiwari]

@aouinizied I split the pcap files into smaller using editcap tool, and the CICFlowMeter works fine, but I am not sure if is it a good way to split the pcap file or not. what do you think? Thank you

i already try this way but when i want to convert my split data using this CICflowmeter, the program was autoclose not respond :(

[meriemferdjouni]

@abmnyuiwari I think any tool for splitting PCAP files should be fine. You can also check SplitCap. It is a free tool to split large PCAPs into smaller ones based on a criterion you select.