Repository navigation
No image #6
Description
Activity
I would appreciate it if you help me with the issue as i try to make a project based on this tool and i have been stack in the process of converting packets and flows to images. Thank you very much in advance.
Thanks for your issue, I'll investigate it.
Did you create the folder
/home/chris/Desktop/thesis/output/benign_data/heiFIPGeneratedImage? Maybe there are some permission issues. So far, we have only tested it on Ubuntu / Debian (non WSL).I found the issue, I will create a pull request soon to fix it.
- linked a pull request that will close this issueFix issue when parsing loop treats maxCount=0 as unlimited packets, #7
on Mar 22, 2026 If possible, please try the fix and test it.
i will check it. But no i had not create the folder /home/chris/Desktop/thesis/output/benign_data/heiFIPGeneratedImage. heiFIPGeneratedImage was the name of the one image which was produced.
Checking it also i modified the save_image function in extractor.cpp with the following:
void save_image(const UInt8Matrix& img, const std::string& output_path) { if (img.empty()) { std::cerr << "[!] Empty image, cannot save: " << output_path << "\n"; return; } for (size_t idx = 0; idx < img.size(); ++idx) { if (img[idx].empty() || img[idx][0].empty()) continue; const auto& grayscale_image = img[idx]; int height = static_cast<int>(grayscale_image.size()); int width = static_cast<int>(grayscale_image[0].size()); cv::Mat mat(height, width, CV_8UC1); for (int i = 0; i < height; ++i) { uint8_t* row_ptr = mat.ptr<uint8_t>(i); for (int j = 0; j < width; ++j) { row_ptr[j] = grayscale_image[i][j]; } } std::string numbered_path = output_path + "_" + std::to_string(idx); std::filesystem::path outp(numbered_path + ".png"); std::filesystem::create_directories(outp.parent_path()); cv::imwrite(outp.string(), mat); } }After this the result is one image per packet of tha pcap is given.
But i check also yours solution.i did try your changes together with mine change in the save_image funtion and now it is work as inteded, 1 pcap with 1000 packets produces 1000 images (not only the first image as before).
Reacted by mrxGreat, thanks for your feedback. Indeed, I already debugged the issue and could verify that
--max-pktsdefaulted to0which was being passed blindly toinit.cpp. Insideinit.cpp's verify loop, it expected0to mean0packets to read, completely aborting packet processing before even looking at the pcap file.In addition, I also updated the build process with
vcpkgin #8 . Building procedure was very tedious,vcpkgmakes the dependency management cleaner.One last question. The heiFIP tool in PacketImage mode, even with the fixes you did, when you give as an input a pcap file with 100 packets the output is only one image (maybe of the first or the last packet). Is this the correct way? And this means that if i want an image for every packet of the pcap file, i have to seperate the pcap to 100 pcaps with 1 packet each?
Example of the test after the fixes is below:
chris@chris-VMware-Virtual-Platform:~/Desktop/thesis/output/benign_data$ ~/Downloads/heiFIP/heiFIP/build/heiFIP --input ~/Desktop/thesis/pcaps/Monday-sample.pcap --output ~/Desktop/thesis/output/benign_data --threads 1 --processor NONE --mode PacketImage --dim 16 --fill 0 --min-dim 10 --max-dim 2000 chris@chris-VMware-Virtual-Platform:~/Desktop/thesis/output/benign_data$ ls ~/Desktop/thesis/output/benign_data | wc -l 1 chris@chris-VMware-Virtual-Platform:~/Desktop/thesis/output/benign_data$ ls heiFIPGeneratedImage.png chris@chris-VMware-Virtual-Platform:~/Desktop/thesis/output/benign_data$With the updated save_image function I suggested in a previous comment this issue is gone, because it genereates, with on run on a 100 packet pcap, 100 images (1 for each packet). What is the expected behavior of the tool?
Thank you very much!In the Python version, for the
PacketImagemode with 100 packets, it result in 100 images.
Same should apply to the C++ version, however, after debugging I see that thesave_image(const UInt8Matrix& img, const std::string& output_path)only saves the first matrix.
@HenriRebitzky any reason why we did this?
Important: this can only apply to thePacketImagemode, currently, we do not split flows (based on the 5-tuple definition). If that is a use-case for you, I can integrate it. For us, we had each flow split in one PCAP file.I delivered a fix in #10 .
I have not used the python version. I only used the C++ version. I will check again after the change you made for the save_image function to store all images and give you feedback. Of course, only in the PacketIamge mode. For the flow modes it would be very good idea to integrate the split based on the 5-tuple, but for now i do the split by my self before the visualization and keep one flow per pcap and give them one by one.
Hi, thank you for addressing the save_image fix — the loop implementation looks correct.
However, there is still a bug in the init.cpp fix for the packet cap. The intended behavior when maxCount == 0 is to read all packets with no limit, but the current implementation still caps at 64:// Current (still broken): size_t limit = (maxCount == 0) ? 64 : maxCount; while (count < limit && reader.getNextPacket(rawPacket))When maxCount == 0 (default, no --max-pkts passed), limit is set to 64, which is identical to the original broken behavior. The fix from PR #7 was correct:
// Correct fix: while ((maxCount == 0 || count < maxCount) && reader.getNextPacket(rawPacket))This means that without --max-pkts, heiFIP still only reads 64 packets per pcap, resulting in empty or near-empty images for most traffic captures. This is reproducible — running heiFIP on any pcap without --max-pkts still produces [!] Empty image, cannot save.
And the exact line to fix in init.cpp — replace:
size_t limit = (maxCount == 0) ? 64 : maxCount; while (count < limit && reader.getNextPacket(rawPacket)) {With:
while ((maxCount == 0 || count < maxCount) && reader.getNextPacket(rawPacket)) {Run examples and their outpus with your new fixes:
chris@chris-VMware-Virtual-Platform:~/Desktop/thesis$ heiFIP -i pcaps/Monday-sample.pcap -o output/benign_data -m PacketImage -t 1 --min-pkts 1 --max-pkts 64 --name monday_sample_images Segmentation fault (core dumped) chris@chris-VMware-Virtual-Platform:~/Desktop/thesis$ heiFIP -i pcaps/Monday-sample.pcap -o output/benign_data -m PacketImage -t 1 --min-pkts 1 --max-pkts 40 --name monday_sample_images Segmentation fault (core dumped) chris@chris-VMware-Virtual-Platform:~/Desktop/thesis$ heiFIP -i pcaps/Monday-sample.pcap -o output/benign_data -m PacketImage -t 1 --min-pkts 1 --name monday_sample_images [!] Empty image, cannot save: output/benign_data/monday_sample_images chris@chris-VMware-Virtual-Platform:~/Desktop/thesis$Reacted by mrxThanks for testing! Indeed, I accidentally changes this code line during some testing...
I will revert it back to the original check!Update in #10
Reacted by Christos-Spyridon Karydis
Describe the bug
When i run the command :
chris@chris-VMware-Virtual-Platform:~/Downloads/heiFIP/heiFIP/build$ ./heiFIP -i ~/Desktop/thesis/pcaps/Monday-WorkingHours.pcap -o ~/Desktop/thesis/output/benign_data -t $(nproc) -p NONE -m PacketImage --dim 16 --fill 0
I get the response :
[!] Empty image, cannot save: /home/chris/Desktop/thesis/output/benign_data/heiFIPGeneratedImage
Also when i run the command :
./heiFIP --input ~/Desktop/thesis/pcaps/Friday-WorkingHours.pcap --output ~/Desktop/thesis/output/malicious_flows --threads $(nproc) --processor HEADER --mode PacketImage --dim 16 --min-pkts 3 --max-pkts 100
The command succeeds but the only thing i took as output is only one image and the pcap i have give as an input is 11GB with a lot of packets.
Steps to reproduce
Download these pcaps (https://www.unb.ca//cic/datasets/ids-2017.html) and run the usual commands.
Expected behavior
When I run either the one or the other command I expect a lot of images to be prodused. At PacketImage mode I expect if the pcap file has 1000 packets to produse 1000 images. Also for the FlowImage mode I expect a lot of images to be prodused and not only one.
Environment