No image

Describe the bug

When i run the command :
chris@chris-VMware-Virtual-Platform:~/Downloads/heiFIP/heiFIP/build$ ./heiFIP -i ~/Desktop/thesis/pcaps/Monday-WorkingHours.pcap -o ~/Desktop/thesis/output/benign_data -t $(nproc) -p NONE -m PacketImage --dim 16 --fill 0

I get the response :
[!] Empty image, cannot save: /home/chris/Desktop/thesis/output/benign_data/heiFIPGeneratedImage

Also when i run the command :
./heiFIP --input ~/Desktop/thesis/pcaps/Friday-WorkingHours.pcap --output ~/Desktop/thesis/output/malicious_flows --threads $(nproc) --processor HEADER --mode PacketImage --dim 16 --min-pkts 3 --max-pkts 100

The command succeeds but the only thing i took as output is only one image and the pcap i have give as an input is 11GB with a lot of packets.

Steps to reproduce

Download these pcaps (https://www.unb.ca//cic/datasets/ids-2017.html) and run the usual commands.

Expected behavior

When I run either the one or the other command I expect a lot of images to be prodused. At PacketImage mode I expect if the pcap file has 1000 packets to produse 1000 images. Also for the FlowImage mode I expect a lot of images to be prodused and not only one.

Environment

OS: Ubuntu 64 bit in VMware and also in WSL at ubuntu terminal in windows.
I have 16gb ram, 4gb geforce rtx and 500gb free space so i think my computer specs is not the problem

I would appreciate it if you help me with the issue as i try to make a project based on this tool and i have been stack in the process of converting packets and flows to images. Thank you very much in advance.

Thanks for your issue, I'll investigate it.

Did you create the folder /home/chris/Desktop/thesis/output/benign_data/heiFIPGeneratedImage ? Maybe there are some permission issues. So far, we have only tested it on Ubuntu / Debian (non WSL).

I found the issue, I will create a pull request soon to fix it.

If possible, please try the fix and test it.

i will check it. But no i had not create the folder /home/chris/Desktop/thesis/output/benign_data/heiFIPGeneratedImage. heiFIPGeneratedImage was the name of the one image which was produced.

Checking it also i modified the save_image function in extractor.cpp with the following:

void save_image(const UInt8Matrix& img, const std::string& output_path) {
    if (img.empty()) {
        std::cerr << "[!] Empty image, cannot save: " << output_path << "\n";
        return;
    }

    for (size_t idx = 0; idx < img.size(); ++idx) {
        if (img[idx].empty() || img[idx][0].empty()) continue;

        const auto& grayscale_image = img[idx];
        int height = static_cast<int>(grayscale_image.size());
        int width  = static_cast<int>(grayscale_image[0].size());

        cv::Mat mat(height, width, CV_8UC1);
        for (int i = 0; i < height; ++i) {
            uint8_t* row_ptr = mat.ptr<uint8_t>(i);
            for (int j = 0; j < width; ++j) {
                row_ptr[j] = grayscale_image[i][j];
            }
        }

        std::string numbered_path = output_path + "_" + std::to_string(idx);
        std::filesystem::path outp(numbered_path + ".png");
        std::filesystem::create_directories(outp.parent_path());
        cv::imwrite(outp.string(), mat);
    }
}

After this the result is one image per packet of tha pcap is given.
But i check also yours solution.

i did try your changes together with mine change in the save_image funtion and now it is work as inteded, 1 pcap with 1000 packets produces 1000 images (not only the first image as before).

Great, thanks for your feedback. Indeed, I already debugged the issue and could verify that --max-pkts defaulted to 0 which was being passed blindly to init.cpp. Inside init.cpp's verify loop, it expected 0 to mean 0 packets to read, completely aborting packet processing before even looking at the pcap file.

In addition, I also updated the build process with vcpkg in #8 . Building procedure was very tedious, vcpkg makes the dependency management cleaner.

One last question. The heiFIP tool in PacketImage mode, even with the fixes you did, when you give as an input a pcap file with 100 packets the output is only one image (maybe of the first or the last packet). Is this the correct way? And this means that if i want an image for every packet of the pcap file, i have to seperate the pcap to 100 pcaps with 1 packet each?

Example of the test after the fixes is below:

chris@chris-VMware-Virtual-Platform:~/Desktop/thesis/output/benign_data$ ~/Downloads/heiFIP/heiFIP/build/heiFIP   --input ~/Desktop/thesis/pcaps/Monday-sample.pcap   --output ~/Desktop/thesis/output/benign_data   --threads 1   --processor NONE   --mode PacketImage   --dim 16   --fill 0   --min-dim 10   --max-dim 2000
chris@chris-VMware-Virtual-Platform:~/Desktop/thesis/output/benign_data$ ls ~/Desktop/thesis/output/benign_data | wc -l
1
chris@chris-VMware-Virtual-Platform:~/Desktop/thesis/output/benign_data$ ls
heiFIPGeneratedImage.png
chris@chris-VMware-Virtual-Platform:~/Desktop/thesis/output/benign_data$

With the updated save_image function I suggested in a previous comment this issue is gone, because it genereates, with on run on a 100 packet pcap, 100 images (1 for each packet). What is the expected behavior of the tool?
Thank you very much!

@HenriRebitzky

In the Python version, for the PacketImage mode with 100 packets, it result in 100 images.
Same should apply to the C++ version, however, after debugging I see that the save_image(const UInt8Matrix& img, const std::string& output_path) only saves the first matrix.
@HenriRebitzky any reason why we did this?
Important: this can only apply to the PacketImage mode, currently, we do not split flows (based on the 5-tuple definition). If that is a use-case for you, I can integrate it. For us, we had each flow split in one PCAP file.

I delivered a fix in #10 .

I have not used the python version. I only used the C++ version. I will check again after the change you made for the save_image function to store all images and give you feedback. Of course, only in the PacketIamge mode. For the flow modes it would be very good idea to integrate the split based on the 5-tuple, but for now i do the split by my self before the visualization and keep one flow per pcap and give them one by one.

Hi, thank you for addressing the save_image fix — the loop implementation looks correct.
However, there is still a bug in the init.cpp fix for the packet cap. The intended behavior when maxCount == 0 is to read all packets with no limit, but the current implementation still caps at 64:

// Current (still broken):
size_t limit = (maxCount == 0) ? 64 : maxCount;
while (count < limit && reader.getNextPacket(rawPacket))

When maxCount == 0 (default, no --max-pkts passed), limit is set to 64, which is identical to the original broken behavior. The fix from PR #7 was correct:

// Correct fix:
while ((maxCount == 0 || count < maxCount) && reader.getNextPacket(rawPacket))

This means that without --max-pkts, heiFIP still only reads 64 packets per pcap, resulting in empty or near-empty images for most traffic captures. This is reproducible — running heiFIP on any pcap without --max-pkts still produces [!] Empty image, cannot save.

And the exact line to fix in init.cpp — replace:

size_t limit = (maxCount == 0) ? 64 : maxCount;
while (count < limit && reader.getNextPacket(rawPacket)) {

With:

while ((maxCount == 0 || count < maxCount) && reader.getNextPacket(rawPacket)) {

Run examples and their outpus with your new fixes:

chris@chris-VMware-Virtual-Platform:~/Desktop/thesis$ heiFIP -i pcaps/Monday-sample.pcap -o output/benign_data -m PacketImage -t 1 --min-pkts 1 --max-pkts 64 --name monday_sample_images
Segmentation fault (core dumped)
chris@chris-VMware-Virtual-Platform:~/Desktop/thesis$ heiFIP -i pcaps/Monday-sample.pcap -o output/benign_data -m PacketImage -t 1 --min-pkts 1 --max-pkts 40 --name monday_sample_images
Segmentation fault (core dumped)
chris@chris-VMware-Virtual-Platform:~/Desktop/thesis$ heiFIP -i pcaps/Monday-sample.pcap -o output/benign_data -m PacketImage -t 1 --min-pkts 1 --name monday_sample_images
[!] Empty image, cannot save: output/benign_data/monday_sample_images
chris@chris-VMware-Virtual-Platform:~/Desktop/thesis$

Thanks for testing! Indeed, I accidentally changes this code line during some testing...
I will revert it back to the original check!

Update in #10

Navigation Menu

Repository navigation

No image #6

Describe the bug

Steps to reproduce

Expected behavior

Environment

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

No image #6

Description

Describe the bug

Steps to reproduce

Expected behavior

Environment

Activity

chriskarydis commented on Mar 20, 2026

stefanDeveloper commented on Mar 22, 2026

stefanDeveloper commented on Mar 22, 2026

stefanDeveloper commented on Mar 22, 2026

chriskarydis commented on Mar 22, 2026

chriskarydis commented on Mar 22, 2026

stefanDeveloper commented on Mar 22, 2026

stefanDeveloper commented on Mar 22, 2026

chriskarydis commented on Mar 23, 2026

stefanDeveloper commented on Mar 23, 2026

stefanDeveloper commented on Mar 24, 2026

chriskarydis commented on Mar 25, 2026

chriskarydis commented on Mar 25, 2026

stefanDeveloper commented on Mar 26, 2026

stefanDeveloper commented on Mar 26, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions