Stenographer Pcaps

[yula-21]

Hi,
I have a quick question, does anyone know what file format are the files saved in /nsm/pcap ?
I need the pcap files but they aren’t in pcap format and i am unable yo open them in wireshark.

[xfaith]

They are in steno format. You can covert them to PCAP either via the GUI front end (Via Dashboard/Alerts/Ect)

Or you can use: so-pcap-export
https://docs.securityonion.net/en/2.3/stenographer.html?highlight=pcap%20export

You would need to know a bit about the pcap you are exporting, using stenoquery (info like x Hours/minutes before, X hours/minutes after, or hard dates.

[yula-21]

Thank you for your quick reply.
I have files that have been copied from the vm and deleted to clean the storage and yet be able to save the data.
Do you know if I can use the export command, or the GUI front end on these steno files, that have been copied from another vm?

[xfaith]

Dont think you can, but recommend a new discussion question for the above.

[yula-21]

Ok, and last question, do you know where can I find the steno query language syntax?
The documentation page doesn't explain.

[xfaith]

https://github.com/google/stenographer#querying

Probably the best place to get the detaisl