PcapExtractStreams
Extract payloads of each stream from a pcap. The payloads will be retrieved with an array of dictionaries of these keys: - protocol - client_ip - client_port - server_ip - server_port - stream_size - stream_text - stream_base64 - outgoing_size - outgoing_text - outgoing_base64 - incoming_size - incoming_text - incoming_base64.
python · PCAP Analysis
Details
| ID | PcapExtractStreams |
|---|---|
| Language | python |
| From Version | 6.2.0 |
| Docker Image | demisto/pcap-miner:1.0.0.10133006 |
| Tags | pcap Utility transformer |
README
Extract payloads of each stream from a pcap.
The payloads will be retrieved with an array of dictionaries of these keys:
- protocol
- client_ip
- client_port
- server_ip
- server_port
- stream_size
- stream_text
- stream_base64
- outgoing_size
- outgoing_text
- outgoing_base64
- incoming_size
- incoming_text
- incoming_base64
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | pcap, Utility, transformer |
Inputs
| Argument Name | Description |
|---|---|
| value | The data of a pcap in base64 from which to extract streams. |
| path | The context path to the pcap (e.g., PcapData.pcap). If you add a comma plus a node name after the path, the output will be set to the node (e.g., PcapData.pcap,out). |
| pcap_type | The data type of the pcap data. |
| bin2txt_mode | The mode of how to convert the binary to text |
| pcap_filter | Filter to apply on PCAP. Wireshark syntax as can be found here: https://www.wireshark.org/docs/man-pages/wireshark-filter.html |
| rsa_decrypt_key | The RSA decryption key in base64. |
| wpa_password | The WPA password. By providing the password you will be able to decrypt encrypted traffic data. |
| filter_keys | Keys of output items by which to filter them. |
| error_action | The action on error to parsing pcap. Possible values are abort (default), ignore, and keep. |
| server_ports | Default server port numbers by which to decide the direction. |
Outputs
There are no outputs for this script.
args: - description: The data of a pcap in base64 to extract streams. name: value - description: The context path to the pcap. name: path - auto: PREDEFINED defaultValue: auto description: The data type of the pcap data. name: pcap_type predefined: - auto - libpcap - cdl-pcap - auto: PREDEFINED defaultValue: text-based-protocol description: The mode of how to convert the binary to text. name: bin2txt_mode predefined: - text-based-protocol - human-readable - description: 'Filter to apply on pcap. Wireshark syntax as can be found here: https://www.wireshark.org/docs/man-pages/wireshark-filter.html' name: pcap_filter - description: The RSA decryption key in base64. name: rsa_decrypt_key - description: The WPA password. By providing the password you will be able to decrypt encrypted traffic data. name: wpa_password - description: Keys of output items by which to filter them. name: filter_keys - auto: PREDEFINED defaultValue: abort description: The action on error to parsing pcap. name: error_action predefined: - abort - ignore - keep - defaultValue: 1-49151 description: Default server port numbers by which to decide the direction. name: server_ports comment: 'Extract payloads of each stream from a pcap. The payloads will be retrieved with an array of dictionaries of these keys: - protocol - client_ip - client_port - server_ip - server_port - stream_size - stream_text - stream_base64 - outgoing_size - outgoing_text - outgoing_base64 - incoming_size - incoming_text - incoming_base64.' commonfields: id: PcapExtractStreams version: -1 contentitemexportablefields: contentitemfields: fromServerVersion: '' dockerimage: demisto/pcap-miner:1.0.0.10133006 enabled: true name: PcapExtractStreams runas: DBotWeakRole script: '' scripttarget: 0 subtype: python3 tags: - pcap - Utility - transformer type: python fromversion: 6.2.0 tests: - No tests (auto formatted)