-
Notifications
You must be signed in to change notification settings - Fork 12
Description
At the moment Brimcap only allows for populating and querying a local "Brimcap root". This means that if a Brim app is connected to a remote lake and accesses a pool that was created by loading a pcap via Brimcap at that remote side, when they click the Packets button, their local Brimcap root will still be queried and the flow will not be found. If the user is savvy enough to run brimcap index locally against the same pcap to populate their personal Brimcap root, that would make the Packets button work as expected. But this is probably asking too much of users.
When contemplating this feature gap, we recognized there's room for something like a "brimcapd server" such that the local Brimcap could do a remote "search" by connecting to the remote brimcapd, which could then extract the relevant flow and return it over the network to be displayed locally in Wireshark.