CapMe: transcript data sometimes overruns the transcript window

[dougburks]

No description provided.

[weslambert]

I ran into an issue with a PCAP today -- pulling it resulted in the data from the transcript running across the page (to the right, past the white boundary, to the end of the browser window) -- is this what you are referring to?

Thanks,
Wes

[dougburks]

Hi Wes,

Yes, that's exactly what I'm referring to. I ran into it while testing a new version of Sguil, so I was originally thinking it was related to the new version of Sguil, but maybe not.

UPDATE: This is definitely not related to the new version of Sguil that I was testing as I was just able to confirm this issue using our current packages in the STABLE repo.

[dougburks]

Steps to duplicate this issue:

• replay some traffic:

sudo tcpreplay -ieth1 -M10 /opt/samples/bredo*

• go to ELSA and search for "tibs 1032"
• click Info, Plugin, getPcap, and authenticate to CapMe

Should look like this:

[weslambert]

I was able to fix this by modifying the following in /var/www/so/capme/.css/capme.css

.txtext_src {
display: inline-block;
width: inherit;
overflow: hidden !important;
text-overflow: ellipsis;
color: #0000ff;
}

.txtext_dst {
display: inline-block;
width: inherit;
overflow: hidden !important;
text-overflow: ellipsis;
color: #ff0000;
}

I'll submit a pull request when I get a chance.

Thanks,
Wes

[dougburks]

submitted for testing:
https://groups.google.com/d/topic/security-onion-testing/3OoHpAmfObM/discussion

[dougburks]

published:
http://blog.securityonion.net/2016/10/securityonion-capme-20121213.html