User Tools

Site Tools


pom-ng:output:pcap_flow

Output pcap_flow

The output pcap_flow will save connections into separate files.

Parameters

Name Type Default value Description
flow_protostringtcpConnections of this protocol will be in separate files.
link_typestringethernetWhat type of frame to save in the pcap file. Possible values are : ethernet, ipv4, docsis, 80211, radiotap, mpeg_ts, ppi.
prefixstring/tmp/${ipv4.src}.${tcp.sport}-${ipv4.dst}.${tcp.dport}-Prefix of the files created. This will need to be changed if the flow_proto is not tcp.
snaplenuint161550Maximum stored size of packets.
unbufferedboolnoWhen set to yes, the packets will directly be written on the disk. This can be useful in some cases but will slow performances.

Events

Name Payload associated Description
pcap_flow_filenoEvent containing informations about files created by the output.

pcap_flow_file

This event starts when a new file is created and ends when the file is closed.

Field Type Description
outputstringName of the output which generated the event.
filenamestringFilename being created.
bytesuint64Number of packet bytes written to the file.
packetsuint64Number of packets written to the file.
infolistList all the info of the first packet. The key is 'proto.field' and the value is the field value.
pom-ng/output/pcap_flow.txt · Last modified: 2014/05/26 14:44 by gmsoft