PCAP is a standard file format for capturing and analyzing network traffic at the packet level, commonly used for network forensics and troubleshooting.

PCAP (Packet Capture) files are widely used in network security to record and analyze network traffic for threat detection, forensic investigations, and troubleshooting. The PCAP connector enables Swimlane Turbine users to automatically extract packet metadata, identify source and destination IP addresses, and parse IPs from text or PCAP files—all within low-code playbooks. By integrating PCAP analysis directly into Turbine, security teams can accelerate incident response, enrich investigations with network telemetry, and automate the extraction of critical network indicators without manual intervention.

The Swimlane PCAP Connector does not require an asset.

The Swimlane PCAP connector has the following capabilities:

Extract packet metadata from an uploaded PCAP file to provide detailed network traffic insights.

{"limit":10}

{"packets":[{"destination_ip":"172.16.1.240","destination_mac":"3e:43:a7:db:7e:91","protocol":"IP","source_ip":"172.16.1.24","source_mac":"00:18:8b:f8:99:35","timestamp":"1340742238.018522"}]}

Parse input text to identify and extract all IP addresses found within the provided content.

{"input_text":"we have this 192.168.1.1 IP address"}

{"ips":[]}

Find and return all source and destination IP addresses identified within the provided PCAP file attachments.

{"limit":100}

{"ips":[]}