---
title: PCAP
slug: connectors/pcap
docTags: 
createdAt: 2026-06-09T16:29:52.533Z
---

PCAP is a standard file format for capturing and analyzing network traffic at the packet level, commonly used for network forensics and troubleshooting.

PCAP (Packet Capture) files are widely used in network security to record and analyze network traffic for threat detection, forensic investigations, and troubleshooting. The PCAP connector enables Swimlane Turbine users to automatically extract packet metadata, identify source and destination IP addresses, and parse IPs from text or PCAP files—all within low-code playbooks. By integrating PCAP analysis directly into Turbine, security teams can accelerate incident response, enrich investigations with network telemetry, and automate the extraction of critical network indicators without manual intervention.

## Prerequisites

The Swimlane PCAP Connector does not require an asset.

## Capabilities

The Swimlane PCAP connector has the following capabilities:

- Analyze PCAP
- Carve IPs from string
- Extract IP's from PCAP

# Actions

## Analyze PCAP

Extract packet metadata from an uploaded PCAP file to provide detailed network traffic insights.

### Input

| **Argument Name**       | **Type** | **Required** | **Description**                      |
| ----------------------- | -------- | ------------ | ------------------------------------ |
| `attachments`           | array    | Required     | PCAP file.                           |
| `attachments.file_name` | string   | Required     | Name of the resource                 |
| `attachments.file`      | string   | Required     | Parameter for Analyze PCAP           |
| `limit`                 | number   | Optional     | Maximum number of packets to return. |

### Input Example

`{"limit":10}`

### Output

| **Parameter**             | **Type** | **Description**                        |
| ------------------------- | -------- | -------------------------------------- |
| `packets`                 | array    | Output field: packets                  |
| `packets.destination_ip`  | string   | Output field: packets.destination\_ip  |
| `packets.destination_mac` | string   | Output field: packets.destination\_mac |
| `packets.protocol`        | string   | Output field: packets.protocol         |
| `packets.source_ip`       | string   | Output field: packets.source\_ip       |
| `packets.source_mac`      | string   | Output field: packets.source\_mac      |
| `packets.timestamp`       | string   | Output field: packets.timestamp        |

### Output Example

`{"packets":[{"destination_ip":"172.16.1.240","destination_mac":"3e:43:a7:db:7e:91","protocol":"IP","source_ip":"172.16.1.24","source_mac":"00:18:8b:f8:99:35","timestamp":"1340742238.018522"}]}`

## Carve IPs

Parse input text to identify and extract all IP addresses found within the provided content.

### Input

| **Argument Name** | **Type** | **Required** | **Description**               |
| ----------------- | -------- | ------------ | ----------------------------- |
| `input_text`      | string   | Required     | Comma-separated IP addresses. |

### Input Example

`{"input_text":"we have this 192.168.1.1 IP address"}`

### Output

| **Parameter** | **Type** | **Description**   |
| ------------- | -------- | ----------------- |
| `ips`         | array    | Output field: ips |

### Output Example

`{"ips":[]}`

## Extract IPs PCAP

Find and return all source and destination IP addresses identified within the provided PCAP file attachments.

### Input

| **Argument Name**       | **Type** | **Required** | **Description**                      |
| ----------------------- | -------- | ------------ | ------------------------------------ |
| `attachments`           | array    | Required     | PCAP File.txt                        |
| `attachments.file_name` | string   | Required     | Name of the resource                 |
| `attachments.file`      | string   | Required     | Parameter for Extract IPs PCAP       |
| `limit`                 | number   | Optional     | Maximum number of packets to return. |

### Input Example

`{"limit":100}`

### Output

| **Parameter** | **Type** | **Description**   |
| ------------- | -------- | ----------------- |
| `ips`         | array    | Output field: ips |

### Output Example

`{"ips":[]}`

# Response Headers

| **Header**   | **Description**                                       | **Example**                   |
| ------------ | ----------------------------------------------------- | ----------------------------- |
| Content-Type | The media type of the resource                        | application/json              |
| Date         | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |