Skip to main content
Version: v4.27

write_pcap

Transforms event stream to PCAP byte stream.

write_pcap

Description​

Transforms event stream to PCAP byte stream.

The structured representation of packets has the pcap.packet schema:

pcap.packet:
  record:
    - linktype: uint64
    - time:
        timestamp: time
    - captured_packet_length: uint64
    - original_packet_length: uint64
    - data: string
PCAPNG

The current implementation does not support PCAPNG. Please reach out if you would like to see support.

Examples​

Write packets as PCAP to a file​

subscribe "packets"
write_pcap
save_file "/logs/packets.pcap"