PCAP Analyzer for Splunk – Getting Started

Share on Facebook0Share on Google+0Tweet about this on TwitterShare on LinkedIn0

Too many times we have situations we suffer from random network connection / latency problems which might be caused by a huge amount of traffic sent over the network or even a problem directly on the specific endpoints.

If you have such kind of problems, in the most of the cases it’s mandatory to capture network traffic on the affected endpoints or even better also on a network device in the middle.

The most popular tool to analyze network captures (.pcap files) is Wireshark.
There are many good tutorials in the Internet which shows good ways to understand and finding the root cause for such Incidents.
I am using Wireshark since more or less 4 years now and after that time and also after many network trace files I’ve looked in there are some features which are not included or hard to get out of Wireshark (e.g. Top Talker Conversations over time, Number of devices between the conversation endpoints).

So I started to think about a way to collect the network packet data by using Splunk. After several weeks checking which will be the best way I’ve decided to use the CSV functionality.
Wireshark includes several sub components including the tshark component which is able to convert the .pcap file to a Splunk readable CSV file.

I came up with the “PCAP Analyzer for Splunk” which can be downloaded from Splunk App page:

How to get started?

“PCAP Analyzer for Splunk” requires a full splunk instance running on *nix / Windows systems and Wireshark needs to be installed.
In summary the most important requirements are the following:

  • Splunk instance with SPLUNK_HOME variable defined.
  • Wireshark installed (on Windows: Wireshark needs to be located at %programfiles%)
  • Confirm that your user has all administrative privileges for the folders “$SPLUNK_HOME/etc/apps/SplunkForPCAP/bin/” and for your Wireshark folder.

What’s next?

As soon as you have installed the “PCAP Analyzer for Splunk” on your Splunk instance the next step is to define a folder on your system which should be monitored for “*.pcap” files.
You can define this folder in the WebUI via Settings –> Data Inputs –> PCAP File Location.

In this configuration panel you have to define a name and a path.
Lets make an example and use as name “myfolder” and as path “/var/tmp/”.

With this configuration a new folder will be created automatically at “$SPLUNK_HOME/etc/apps/SplunkForPCAP/”. It is the “local” folder which includes an “inputs.conf” file.

How to get my first “.pcap” file into Splunk?

If you can confirm that the above steps has been done successful, the next step is to put a “*.pcap” file in your folder you have defined (e.g. /var/tmp/).
Now the rest is done by the app.

“PCAP Analyzer for Splunk” checks every minute if a new pcap file has been added to your folder.
If it finds a new pcap file it will be converted and indexed automatically into Splunk.

You can open a panel in the application and you should find your pcap file in the dropdown menu.

Good things to know!

  • As soon as your “*.pcap” file is processed, it will be moved to “$SPLUNK_HOME/var/log/pcap/PCAPConverted”. No need to worry 🙂
  • Your files will be converted to a CSV file which are created in the folder “$SPLUNK_HOME/var/log/pcap/PCAPcsv”. You can delete those file after the indexing is done.


Please find more details at https://devops-online.com/pcap-analyzer/

In case you have other questions or problems, please contact me via Email or write into the comments.


2 thoughts on “PCAP Analyzer for Splunk – Getting Started

Leave a Reply

Your email address will not be published. Required fields are marked *