|
| 1 | +# Pcap Live (input plugin) |
| 2 | + |
| 3 | +The Pcap Live input plugin allows for real-time packet capture on a specified network interface. |
| 4 | + |
| 5 | +## Example configuration |
| 6 | + |
| 7 | +```yaml |
| 8 | +input_plugin: |
| 9 | + pcap_live: |
| 10 | + interface: "eth0" |
| 11 | + ### Optional parameters |
| 12 | + snap_length: 65535 |
| 13 | + bpf_filter: null |
| 14 | +``` |
| 15 | +
|
| 16 | +## Parameters |
| 17 | +
|
| 18 | +**Mandatory parameters:** |
| 19 | +
|
| 20 | +|Parameter | Description | |
| 21 | +|---|---| |
| 22 | +|__interface__| The network interface to capture packets from (e.g., eth0, ens33, etc.). This is required for the plugin to know which network interface to monitor. | |
| 23 | +
|
| 24 | +----- |
| 25 | +
|
| 26 | +**Optional parameters:** |
| 27 | +|Parameter | Default | Description | |
| 28 | +|---|---|---| |
| 29 | +|__snap_length__ | 65535 | Maximum packet capture length in bytes. It defines the size of the packet that will be captured. The default value captures full packets (up to 65535 bytes). | |
| 30 | +|__bpf_filter__ | null | A Berkeley Packet Filter (BPF) string for packet filtering. If null, no filter is applied. If a filter is specified, only packets matching the filter criteria will be captured. | |
| 31 | +
|
| 32 | +# Pcap File (input plugin) |
| 33 | +
|
| 34 | +The Pcap File input plugin allows you to read and process packets from an existing .pcap file. This is useful for analyzing historical packet captures or testing with predefined data. |
| 35 | +
|
| 36 | +## Example configuration |
| 37 | +
|
| 38 | +```yaml |
| 39 | +input_plugin: |
| 40 | + pcap_file: |
| 41 | + file: "input.pcap" |
| 42 | + ### Optional parameters |
| 43 | + bpf_filter: null |
| 44 | +``` |
| 45 | +
|
| 46 | +## Parameters |
| 47 | +
|
| 48 | +**Mandatory parameters:** |
| 49 | +
|
| 50 | +|Parameter | Description | |
| 51 | +|---|---| |
| 52 | +|__file__| Path to the pcap file that contains the packet data to be read. | |
| 53 | +
|
| 54 | +----- |
| 55 | +
|
| 56 | +**Optional parameters:** |
| 57 | +|Parameter | Default | Description | |
| 58 | +|---|---|---| |
| 59 | +|__bpf_filter__ | null | A Berkeley Packet Filter (BPF) string for packet filtering. If null, no filter is applied. If a filter is specified, only packets matching the filter criteria will be captured. | |
0 commit comments