Skip to content

Latest commit

 

History

History
10 lines (9 loc) · 622 Bytes

README.md

File metadata and controls

10 lines (9 loc) · 622 Bytes

pcap-2-bro

Replay PCAP through a rock sensor

Command Line Options

  • -w --workers NUMBER (number of threads to allocate to pool)
  • -d --directory /path/to/dir (top directory if using the -r option or directory that contains Pcap files)
  • -r --recursive (if you have multiple pcaps in layered directories)
  • -f --file /path/to/pcap/file (single pcap ingest)
  • -v --verbose (use if you want status updates every 10 seconds on screen)
  • -s --source UUID or Source Name. This replaces the ROCK::sensor_id variable so that you can search for the data easily inside of ROCK and identify the source it came from.