Skip to content

Commit 684a3cd

Browse files
author
Pavel Siska
committed
Pcap: Add README
1 parent d81cbc8 commit 684a3cd

File tree

1 file changed

+59
-0
lines changed

1 file changed

+59
-0
lines changed

src/plugins/input/pcap/README.md

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Pcap Live (input plugin)
2+
3+
The Pcap Live input plugin allows for real-time packet capture on a specified network interface.
4+
5+
## Example configuration
6+
7+
```yaml
8+
input_plugin:
9+
pcap_live:
10+
interface: "eth0"
11+
### Optional parameters
12+
snap_length: 65535
13+
bpf_filter: null
14+
```
15+
16+
## Parameters
17+
18+
**Mandatory parameters:**
19+
20+
|Parameter | Description |
21+
|---|---|
22+
|__interface__| The network interface to capture packets from (e.g., eth0, ens33, etc.). This is required for the plugin to know which network interface to monitor. |
23+
24+
-----
25+
26+
**Optional parameters:**
27+
|Parameter | Default | Description |
28+
|---|---|---|
29+
|__snap_length__ | 65535 | Maximum packet capture length in bytes. It defines the size of the packet that will be captured. The default value captures full packets (up to 65535 bytes). |
30+
|__bpf_filter__ | null | A Berkeley Packet Filter (BPF) string for packet filtering. If null, no filter is applied. If a filter is specified, only packets matching the filter criteria will be captured. |
31+
32+
# Pcap File (input plugin)
33+
34+
The Pcap File input plugin allows you to read and process packets from an existing .pcap file. This is useful for analyzing historical packet captures or testing with predefined data.
35+
36+
## Example configuration
37+
38+
```yaml
39+
input_plugin:
40+
pcap_file:
41+
file: "input.pcap"
42+
### Optional parameters
43+
bpf_filter: null
44+
```
45+
46+
## Parameters
47+
48+
**Mandatory parameters:**
49+
50+
|Parameter | Description |
51+
|---|---|
52+
|__file__| Path to the pcap file that contains the packet data to be read. |
53+
54+
-----
55+
56+
**Optional parameters:**
57+
|Parameter | Default | Description |
58+
|---|---|---|
59+
|__bpf_filter__ | null | A Berkeley Packet Filter (BPF) string for packet filtering. If null, no filter is applied. If a filter is specified, only packets matching the filter criteria will be captured. |

0 commit comments

Comments
 (0)