def check_pcaps():
    """
    Check of the pcaps and alert on potential issues.
    Add other checks here as needed.
    """
    print_debug("check_pcaps() called")

    # Check of the pcaps to make sure none were submitted with TCP packets but no TCP packets have the SYN flag
    # only call if no alerts fired
    if os.path.getsize(JOB_ALERT_LOG) == 0:
        try:
            if os.path.exists(TCPDUMP_BINARY):
                for pcap in PCAP_FILES:
                    # check for TCP packets
                    if (
                        len(
                            subprocess.Popen(
                                "%s -nn -q -c 1 -r %s -p tcp 2>/dev/null"
                                % (TCPDUMP_BINARY, pcap),
                                shell=True,
                                stdout=subprocess.PIPE,
                            ).stdout.read()
                        )
                        > 0
                    ):
                        # check for SYN packets; this only works on IPv4 packets
                        if (
                            len(
                                subprocess.Popen(
                                    '%s -nn -q -c 1 -r %s "tcp[tcpflags] & tcp-syn != 0" 2>/dev/null'
                                    % (TCPDUMP_BINARY, pcap),
                                    shell=True,
                                    stdout=subprocess.PIPE,
                                ).stdout.read()
                            )
                            == 0
                        ):
                            # check IPv6 packets too
                            if (
                                len(
                                    subprocess.Popen(
                                        '%s -nn -q -c 1 -r %s "ip6 and tcp and ip6[0x35] & 0x2 != 0" 2>/dev/null'
                                        % (TCPDUMP_BINARY, pcap),
                                        shell=True,
                                        stdout=subprocess.PIPE,
                                    ).stdout.read()
                                )
                                == 0
                            ):
                                print_error(
                                    'As Dalton says, "pain don\'t hurt." But an incomplete pcap sure can.'
                                    "\n\n"
                                    "The pcap file '%s' contains TCP traffic but does not "
                                    "contain any TCP packets with the SYN flag set."
                                    "\n\n"
                                    "Almost all IDS rules that look for TCP traffic require "
                                    "an established connection.\nYou will need to provide a more complete "
                                    "pcap if you want accurate results."
                                    "\n\n"
                                    "If you need help crafting a pcap, Flowsynth may be able to help --\n"
                                    "https://github.com/secureworks/flowsynth"
                                    "\n\n"
                                    'And, "there\'s always barber college...."'
                                    % os.path.basename(pcap)
                                )
            else:
                print_debug(
                    "In check_pcaps() -- no tcpdump binary found at %s" % TCPDUMP_BINARY
                )
        except Exception as e:
            if not str(e).startswith("As Dalton says"):
                print_debug("Error doing TCP SYN check in check_pcaps():\n%s" % e)

    # check snaplen of pcaps
    try:
        for pcap in PCAP_FILES:
            snaplen_offset = 16
            pcapng = False
            little_endian = False
            snaplen = 65535

            # get first 40 bytes of pcap file
            with open(pcap, "rb") as fh:
                bytes = fh.read(44)

            magic = binascii.hexlify(bytes[0:4]).decode("ascii")
            if magic.lower() == "0a0d0d0a":
                # this is pcapng and these aren't the byte-order magic bytes
                snaplen_offset = 40
                pcapng = True
                # get the correct byte-order magic bytes for pcapng
                magic = binascii.hexlify(bytes[8:12]).decode("ascii")
            else:
                # this is libpcap, we have the magic
                pcapng = False
            # now determine endian-ness
            if magic.lower() == "a1b2c3d4":
                # this is "big endian"
                little_endian = False
            elif magic.lower() == "4d3c2b1a" or magic.lower() == "d4c3b2a1":
                # this is little endian
                little_endian = True
            else:
                print_debug(
                    "in check_pcaps() - Pcap Byte-Order Magic field not found in file '%s'.  Is this a valid pcap?"
                    % os.path.basename(pcap)
                )
                continue

            # get snaplen
            if little_endian:
                snaplen = struct.unpack(
                    "<i", bytes[snaplen_offset : snaplen_offset + 4]
                )[0]
            else:
                snaplen = struct.unpack(
                    ">i", bytes[snaplen_offset : snaplen_offset + 4]
                )[0]

            # Python 2.4 doesn't support this so doing it the ugly way
            # print_debug("Packet capture file \'%s\' is format %s, %s, and has snaplen of %d bytes." % (os.path.basename(pcap), ('pcapng' if pcapng else 'libpcap'), ('little endian' if little_endian else 'big endian'), snaplen))
            debug_msg = "Packet capture file '%s' is format " % os.path.basename(pcap)
            if pcapng:
                debug_msg += "pcapng, "
            else:
                debug_msg += "libpcap, "
            if little_endian:
                debug_msg += "little endian, and has snaplen of %d bytes." % snaplen
            else:
                debug_msg += "big endian, and has snaplen of %d bytes." % snaplen
            print_debug(debug_msg)

            if snaplen < 65535:
                print_debug(
                    "Warning: '%s' was captured using a snaplen of %d bytes.  This may mean you have truncated packets."
                    % (os.path.basename(pcap), snaplen)
                )

            # validate snaplen
            if snaplen < 1514:
                warning_msg = ""
                if not os.path.getsize(JOB_ERROR_LOG) == 0:
                    warning_msg += "\n----------------\n\n"
                warning_msg += (
                    "Warning: '%s' was captured using a snaplen of %d bytes.  This may mean you have truncated packets."
                    % (os.path.basename(pcap), snaplen)
                )
                if snaplen == 1500:
                    warning_msg += "\n\nSome sandboxes (Bluecoat/Norman) will put a hardcoded snaplen of 1500 bytes\n"
                    warning_msg += "on pcaps even when the packets are larger than 1500 bytes.  This can result in the sensor throwing away these\n"
                    warning_msg += "packets and not inspecting them.  If this is the case, try saving the file in Wireshark in pcapng format, opening up\n"
                    warning_msg += "that pcapng file in Wireshark, and saving it as a libpcap file. This should set the snaplen to 65535."
                warning_msg += "\n\nThis is just a warning message about the pcap. The job ran successfully and the generated alerts as well as other\n"
                warning_msg += "results have been returned."
                print_error(warning_msg)
    except Exception as e:
        if not str(e).startswith("Warning:"):
            print_debug("Error doing snaplen check in check_pcaps(): %s" % e)

    Check of the pcaps and alert on potential issues.
    Add other checks here as needed.
    
dalton-agent/dalton-agent.py