v0.5
Filtering and Export
Process Netcap audit records and extract the data you are interested in
Exporting Data with net dump
Netcap offers a simple interface to filter for specific fields and select only those of interest. Filtering and exporting specific fields can be performed with all available audit record types, over a uniform command-line interface. By default, output is generated as CSV with the field names added as first line. It is also possible to use a custom separator string. Fields are exported in the order they are named in the select statement. Sub structures of audit records (for example IPv4Options from an IPv4 packet), are converted to a human readable string representation. More examples for using this feature on the command-line can be found in the usage section.
Netcap offers a simple command-line interface to select fields of interest from the gathered audit records.
Examples
Show available header fields:
1
$ net dump -read UDP.ncap.gz -fields
2
Timestamp,SrcPort,DstPort,Length,Checksum,PayloadEntropy,PayloadSize
Copied!
Print all fields for the supplied audit record:
1
$ net dump -read UDP.ncap.gz
2
1331904607.100000,53,42665,120,41265,4.863994469989251,112
3
1331904607.100000,42665,53,53,1764,4.0625550894074385,45
4
1331904607.290000,51190,53,39,22601,3.1861758166070766,31
5
1331904607.290000,56434,53,39,37381,3.290856864924384,31
6
1331904607.330000,137,137,58,64220,3.0267194361875682,50
7
...
Copied!
Selecting fields will also define their order:
1
$ net dump -read UDP.ncap.gz -select Length,SrcPort,DstPort,Timestamp
2
Length,SrcPort,DstPort,Timestamp
3
145,49792,1900,1499254962.084372
4
145,49792,1900,1499254962.084377
5
145,49792,1900,1499254962.084378
6
145,49792,1900,1499254962.084379
7
145,49792,1900,1499254962.084380
8
...
Copied!
Print selection in the supplied order and convert timestamps to UTC time:
1
$ net dump -read UDP.ncap.gz -select Timestamp,SrcPort,DstPort,Length -utc
2
2012-03-16 13:30:07.1 +0000 UTC,53,42665,120
3
2012-03-16 13:30:07.1 +0000 UTC,42665,53,53
4
2012-03-16 13:30:07.29 +0000 UTC,51190,53,39
5
2012-03-16 13:30:07.29 +0000 UTC,56434,53,39
6
2012-03-16 13:30:07.33 +0000 UTC,137,137,58
7
...
Copied!
To save the output into a new file, simply redirect the standard output:
1
$ net dump -read UDP.ncap.gz -select Timestamp,SrcPort,DstPort,Length -utc > UDP.csv
Copied!
Last modified 1yr ago
Copy link