This input specifies the file entry ID for the PCAP file if the user provided the file in the incident. This playbook does not use any integrations. This playbook uses the following sub-playbooks, integrations, and scripts. In order to demonstrate the entire flow make sure that at least on of the following playbook inputs is configured in order for search results to exist. The playbooks is meant to be a demonstration of all the PCAP analysis capabilities however it is more likely to use each of the subplaybooks seperatly.

Carve (extract) files found in the http, smb and other protocols and perform enrichment and detonation.Parse and enrich detected indicators such as IP addresses, URLs, email addresses and domains found by the search.Search for specific values in a PCAP file.

This playbook leverages all of the PCAP miner and PCAP file extractor sub playbook capabilities, including: You can use cpan or any other way to install them.This Playbook is part of the PCAP Analysis Pack. you'll need perl and some perl libraries.clone this repo or copy the file to your system.It's based/inspired by script posted by walto at If the pcap file captured has multiple transport stream, on different IP (group) or UDP Ports, you must use the -p and or -i -p so the extracted TS has only the selected mpeg audio/video. I had the need troubleshoot multicast traffic, and the closest way to the network card to capture the traffic to evaluate packet loss or damage is using tools like tcpdump, wireshark or other pcap capture option.īut the evaluation of the data stream on a MPEG (video/audio) level using tools like dvbinspector, ffmpeg and others, needs the data correctly formatted as a MPEG TransportStream. It allow you to convert a pcap capture file to a valid mpeg ts video file. Pcap2mpegts allows you to extract MPEG video from 'pcap' capture (tcpdump/wireshark) of UDP Multicast traffic.

Wireshark pcap analysis