PcapFileExtractStreams

Extract payloads of each stream from a pcap file.

python · PCAP Analysis

Details

IDPcapFileExtractStreams
Languagepython
From Version6.2.0
Docker Imagedemisto/pcap-miner:1.0.0.10133006
Tagspcap file Utility

README

Extract payloads of each stream from a pcap file.

Script Data

Name Description
Script Type python3
Tags pcap, file, Utility

Inputs

Argument Name Description
entry_id The entry_id of the pcap file from which to extract streams.
bin2txt_mode The mode of how to convert the binary to text.
pcap_filter Filter to apply on pcap. Wireshark syntax as can be found here: https://www.wireshark.org/docs/man-pages/wireshark-filter.html
rsa_decrypt_key_entry_id The entry ID for the RSA decryption key.
wpa_password The WPA password. By providing the password you will be able to decrypt encrypted traffic data.
filter_keys Keys of output items by which to filter them.
verbose Set to true to generate stream entries, otherwise false.
server_ports Default server port numbers by which to decide the direction.

Outputs

Path Description Type
PCAPStream.entry_id The entry ID of the pcap file parsed. string
PCAPStream.protocol Protocol. string
PCAPStream.client_ip Client IP address. string
PCAPStream.client_port Client port number. number
PCAPStream.server_ip Server IP address. string
PCAPStream.server_poprt Server port nream data in bytes. number
PCAPStream.stream_text The data stream in text. string
PCAPStream.stream_base64 The data stream in base64. string
PCAPStream.outgoing_size Size of the outgoing data in bytes. number
PCAPStream.outgoing_text The outgoing data stream in text. string
PCAPStream.outgoing_base64 The outgoing data stream in base64. string
PCAPStream.incoming_size Size of the incoming data in bytes. number
PCAPStream.incoming_text The incoming data stream in text. string
PCAPStream.incoming_base64 The incoming data stream in base64. string

Source

PcapFileExtractStreams.py PcapFileExtractStreams_test.py PcapFileExtractStreams.yml
Download History Raw 
args:
- description: The entry_id of the PCAP file from which to extract streams.
  name: entry_id
  required: true
- auto: PREDEFINED
  defaultValue: text-based-protocol
  description: The mode of how to convert the binary to text.
  name: bin2txt_mode
  predefined:
  - text-based-protocol
  - human-readable
- description: 'Filter to apply on PCAP. Wireshark syntax as can be found here: https://www.wireshark.org/docs/man-pages/wireshark-filter.html'
  name: pcap_filter
- description: The entry ID for the RSA decryption key.
  name: rsa_decrypt_key_entry_id
- description: The WPA password. By providing the password you will be able to decrypt encrypted traffic data.
  name: wpa_password
- description: Keys of output items by which to filter them.
  name: filter_keys
  type: unknown
- auto: PREDEFINED
  defaultValue: 'false'
  description: Set to true to generate stream entries, otherwise false.
  name: verbose
  predefined:
  - 'true'
  - 'false'
  type: unknown
- defaultValue: 1-49151
  description: Default server port numbers by which to decide the direction.
  name: server_ports
comment: Extract payloads of each stream from a pcap file.
commonfields:
  id: PcapFileExtractStreams
  version: -1
contentitemexportablefields:
  contentitemfields:
    fromServerVersion: ''
dockerimage: demisto/pcap-miner:1.0.0.10133006
enabled: true
name: PcapFileExtractStreams
outputs:
- contextPath: PCAPStream.entry_id
  description: The entry ID of the pcap file parsed.
  type: string
- contextPath: PCAPStream.protocol
  description: Protocol.
  type: string
- contextPath: PCAPStream.client_ip
  description: Client IP address.
  type: string
- contextPath: PCAPStream.client_port
  description: Client port number.
  type: number
- contextPath: PCAPStream.server_ip
  description: Server IP address.
  type: string
- contextPath: PCAPStream.server_poprt
  description: Server port number.
  type: number
- contextPath: PCAPStream.stream_size
  description: Size of the stream data in bytes.
  type: number
- contextPath: PCAPStream.stream_text
  description: The data stream in text.
  type: string
- contextPath: PCAPStream.stream_base64
  description: The data stream in base64.
  type: string
- contextPath: PCAPStream.outgoing_size
  description: Size of the outgoing data in bytes.
  type: number
- contextPath: PCAPStream.outgoing_text
  description: The outgoing data stream in text.
  type: string
- contextPath: PCAPStream.outgoing_base64
  description: The outgoing data stream in base64.
  type: string
- contextPath: PCAPStream.incoming_size
  description: Size of the incoming data in bytes.
  type: number
- contextPath: PCAPStream.incoming_text
  description: The incoming data stream in text.
  type: string
- contextPath: PCAPStream.incoming_base64
  description: The incoming data stream in base64.
  type: string
runas: DBotWeakRole
script: ''
scripttarget: 0
subtype: python3
tags:
- pcap
- file
- Utility
type: python
fromversion: 6.2.0
tests:
- No tests (auto formatted)