README
¶
brimcap 
A command line utility for converting pcaps into the flexible, searchable zng data format as seen in the Brim desktop app and the zq command line utility.
Quickstart
- Install brimcap
- Have a pcap handy (or download a sample pcap)
- Run
brimcap analyzebrimcap analyze sample.pcap > sample.zng - Explore with zq
zq -z "zeek=count(has(_path)), alerts=count(has(event_type='alert'))" sample.zng
Usage with Brim desktop app
The output from analyze can be automatically loaded into the
Brim desktop app using the brimcap load
command (builds for linux, macOS and windows available)*:
- Have the Brim desktop app running.
- Run the
brimcap loadcommand:brimcap load sample.pcap
* A more seamless integration is coming soon.
Install
The prebuilt brimcap package can found in the releases section of the brimcap Github repo.
The release includes a special brimdata build of zeek and suricata that is preconfigured to provide a good experience out of the box for brimcap analyze.
Unzip the artifact and add the brimcap directory to your $PATH environment variable.
export PATH=$PATH:/Path/To/brimcap
Having a problem?
Please browse the wiki to review common problems and helpful tips before opening an issue.
Build From Source
To build from source, Go version 1.16 or later is required.
To build the brimcap package, clone this repo and run make build:
git clone https://github.com/brimdata/brimcap
cd brimcap
make build
make build will download the brimdata prebuilt / preconfigured zeek and
suricata artifacts, compile the brimcap binary and package them into
build/dist.
The executables will be located here:
./build/dist/brimcap
./build/dist/zeek/zeekrunner
./build/dist/suricata/suricatarunner
Documentation
¶
Index ¶
- type File
- type Root
- func (r Root) AddPcap(path string, limit int, warner zbuf.Warner) (nano.Span, error)
- func (r Root) AddPcapWithIndex(path string, index pcap.Index) (err error)
- func (r Root) DeletePcap(path string) error
- func (r Root) IndexPath(path string) string
- func (r Root) Pcaps() ([]File, error)
- func (r Root) Search(ctx context.Context, req Search, w io.Writer) error
- func (r Root) SymlinkPath(path string) string
- type Search
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Root ¶
type Root string
func (Root) AddPcap ¶
AddPcap adds the pcap path to the BRIMCAP_ROOT, meaning a symlink for the pcap is added to the root directory along with an index of the pcap.
func (Root) AddPcapWithIndex ¶
func (Root) DeletePcap ¶
DeletePcap removes all files associated with the pcap path (if they exist).
func (Root) SymlinkPath ¶
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
mock
Package mock is a generated GoMock package.
|
Package mock is a generated GoMock package. |
|
cmd
|
|
|
brimcap
command
|
|
|
Package ranger provides a way to take a function expressed as cartesian points, downsample the points to a bounded number of bins by computing a range of the points that represent the downsampled bins (called the Envelope), then querying the Envelope with a range to find the smallest domain of X values that cover the range queried.
|
Package ranger provides a way to take a function expressed as cartesian points, downsample the points to a bounded number of bins by computing a range of the points that represent the downsampled bins (called the Envelope), then querying the Envelope with a range to find the smallest domain of X values that cover the range queried. |
|
Package slicer provides an io.Reader that returns subsets of a file.
|
Package slicer provides an io.Reader that returns subsets of a file. |
|
Package ztail provides facilities for watching a directory of logs, tailing all the files created within it and transforming the data into zng data.
|
Package ztail provides facilities for watching a directory of logs, tailing all the files created within it and transforming the data into zng data. |