search

robcowart / elastiflow

Network flow analytics (Netflow, sFlow and IPFIX) with the Elastic Stack
Other
2.49k stars 596 forks source link

Import PCAP file from a USB File to ElasticFlow #699

Closed minhanh1234 closed 3 years ago

minhanh1234 commented 3 years ago

Hi

I received several PCAP files from a friend to be analyze. I am wondering if you have a command we can run to import the PCAP to the ElasticSearch (ElasticFlow).

The current process listen on logstash ip/port to capture the netflow.

Thanks

robcowart commented 3 years ago

Some users have had success using pmacct to read a PCAP and send the resulting flow records to ElastiFlow.