PCAP

pcap is a standard file format for capturing and analyzing network traffic at the packet level, commonly used for network forensics and troubleshooting pcap (packet capture) files are widely used in network security to record and analyze network traffic for threat detection, forensic investigations, and troubleshooting the pcap connector enables swimlane turbine users to automatically extract packet metadata, identify source and destination ip addresses, and parse ips from text or pcap files—all within low code playbooks by integrating pcap analysis directly into turbine, security teams can accelerate incident response, enrich investigations with network telemetry, and automate the extraction of critical network indicators without manual intervention prerequisites the swimlane pcap connector does not require an asset capabilities the swimlane pcap connector has the following capabilities analyze pcap carve ips from string extract ip's from pcap actions analyze pcap extract packet metadata from an uploaded pcap file to provide detailed network traffic insights input argument name type required description attachments array required pcap file attachments file name string required name of the resource attachments file string required parameter for analyze pcap limit number optional maximum number of packets to return input example {"limit" 10} output parameter type description packets array output field packets packets destination ip string output field packets destination ip packets destination mac string output field packets destination mac packets protocol string output field packets protocol packets source ip string output field packets source ip packets source mac string output field packets source mac packets timestamp string output field packets timestamp output example {"packets" \[{"destination ip" "172 16 1 240","destination mac" "3e 43\ a7\ db 7e 91","protocol" "ip","source ip" "172 16 1 24","source mac" "00 18 8b\ f8 99 35","timestamp" "1340742238 018522"}]} carve ips parse input text to identify and extract all ip addresses found within the provided content input argument name type required description input text string required comma separated ip addresses input example {"input text" "we have this 192 168 1 1 ip address"} output parameter type description ips array output field ips output example {"ips" \[]} extract ips pcap find and return all source and destination ip addresses identified within the provided pcap file attachments input argument name type required description attachments array required pcap file txt attachments file name string required name of the resource attachments file string required parameter for extract ips pcap limit number optional maximum number of packets to return input example {"limit" 100} output parameter type description ips array output field ips output example {"ips" \[]} response headers header description example content type the media type of the resource application/json date the date and time at which the message was originated thu, 01 jan 2024 00 00 00 gmt