Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

why does metron pcap file contains only keys, which are timestamps?

Highlighted

why does metron pcap file contains only keys, which are timestamps?

Contributor

Hi,

From the documentation [below] I understand PCAP files that are stored in HDFS sequenceFile has the structure of timestamp as the key and a value of the raw data. However, there are files that ONLY contains keys with no value. If no value is captured; why would we need the key? When would this be useful?

  • A key which is the byte representation of a 64-bit unsigned long representing a time-unit since the unix epoch
  • A value which is the raw packet data without header (either global pcap header or packet header)

Thank you in advance for feedbacks.

Don't have an account?
Coming from Hortonworks? Activate your account here