search

DanielSchwartz1 / SplunkForPCAP

The PCAP Analyzer for Splunk includes useful Dashboards to analyze network packet capture files from Wireshark or Network Monitor (.pcap) and network streaming data (Splunk App for Stream). The App includes Dashboards which will show you: - The Top Talker IP's, Protocols, VLANs, Conversations - Detailed overview about IP Conversations, Packet Loss, TCP Error's, Round Trip Time - Conversation Sankey Diagram (by Packets, by Bytes, by Destination Port) - Microburst Dashboard (Bit timechart) - DNS / NFS / HTTP / Keep Alive Communication Dashboards - Hop Calculator between two IP's ROADMAP - Support for more protocols and more use cases - Dashboards will change to highlight the most important use cases for troubleshooting. FAQ http://devops-online.com/splunk-pcap-analyzer
MIT License
41 stars 7 forks source link

Not sure if issue but ... Install Linux #4

Closed collse closed 6 years ago

collse commented 6 years ago

I had to do a few tweak to get this to work on Ubuntu.

1) wireshark didnt include tshark - needs manual install on ubuntu 2) /opt/splunk/etc/apps/SplunkForPCAP/bin/pcap2csv.sh caused errors

changed: if [[ "$TSHARK_V" =~ "$V2" ]]; then ./$V11 elif [ "$TSHARK_V1" -le "10" ]; then ./$V10 else ./$V11

to: if [[ "$TSHARK_V" =~ "$V2" ]]; then $V11 elif [ "$TSHARK_V1" -le "10" ]; then $V10 else $V11

as otherwise it tries to call the script with ./ which returns a file/command not found

not sure if the above is a general issue but I thought I mention it ...

feature request: allow pcap upload to /var/tmp from the interface ...

DanielSchwartz1 commented 6 years ago

Hi Collse, thanks for the hint. I will check it. First time i hear about it.

Regarding your request. I am happy to hear new ideas. Can you specify what you mean?

collse commented 6 years ago

basically, a frontend that allows the pcap upload via your interface and that it will upload it to the specified directory, from where it will be read ... so I dont need to upload the pcaps via scp or so ..

DanielSchwartz1 commented 6 years ago

Got it! Thanks! btw. I've uploaded new version 4.1.9 to splunkbase. As soon as it will be approved, I will close that issue. The new version will have your tweak implemented. Thanks again.

collse commented 6 years ago

Happy to help - keep up the good work!

DanielSchwartz1 commented 6 years ago

Version 4.1.10 is available now.