NETCAP
OverviewGitHubHomepageGoDoc
Search…
v0.5
Overview
Audit Records
Specification
Installation
Quickstart
Configuration
Bash Completion
Packet Collection
Audit Record Labeling
HTTP Proxy
USB Capture
Payload Capture
Distributed Collection
Workers
Filtering and Export
Data Compression
Internals
Metrics
Resolvers
TLS Fingerprinting
Reassembly
Deep Packet Inspection
Live Capture
Maltego Integration
Logging
Packet Contexts
Industrial Control Systems
File Extraction
Email Extraction
Device Profiles
Python Integration
Changelog
Troubleshooting
Unit Tests
Extension
Downloads
Docker Containers
FAQ
Contributing
License
Powered By GitBook
Python Integration
Read Netcap Audit records from Python

Source Code

The Python library for interacting with netcap audit records has been published here:
GitHub - dreadl0ck/pynetcap: Access to NETCAP audit records from Python
GitHub

Usage

Read into python dictionary

Currently it is possible to retrieve the audit records as python dictionary:
#!/usr/bin/python
​
import pynetcap as nc
​
reader = nc.NCReader('pcaps/HTTP.ncap.gz')
​
reader.read(dataframe=False)
print("RECORDS:")
print(reader.records)

Read into pandas dataframe

Retrieving the audit records as pandas dataframe:
#!/usr/bin/python
​
import pynetcap as nc
​
reader = nc.NCReader('pcaps/HTTP.ncap.gz')
​
reader.read(dataframe=True)
print("[INFO] completed reading the audit record file:", reader.filepath)
print("DATAFRAME:")
print(reader.df)
Previous
Device Profiles
Next
Changelog
Last modified 3yr ago
Copy link
Outline
Source Code
Usage
Read into python dictionary
Read into pandas dataframe