Export Large Amounts of PCAP

[testsubject9]

I have a SecOnion2 Node that captured Terabytes of PCAP. I am looking for a solution to export the PCAP in meaningful segments, or in whole Terabytes. I have tried the Stenoread(so-pcap-export) option but the max export allowed is ~2GB. Is there a way to copy the all the stenographer output files to a new server and convert them as a whole? Looking for a solution that will allow 500GB+ exports hopefully.

[reyesj2]

Currently not supported by stenographer. A hacky work around is you could take /pcap /pcapindex and your steno certificates to another machine and from there you could run a python script to run through and take chunks of steno and convert to raw PCAP.

If you're looking to run raw PCAP through an alternative tool easiest solution would be to use the built in PCAP function and include the entire suspicious traffic session and download it from the PCAP page

[jmdale83]

Do you have an example of a working script that can do this? My team is generating about 10TB of pcap a day and we can only store about 48 hours of pcap before the sensor purges data. So my team wouldn't be able to get the raw data for anything that comes in over the weekend before it is gone. We want to implement a solution to offload data to another server that has a lot more storage and carve it later but as you mentioned, it is unsupported.

[PeanutTheAdmin]

+1