PCAP Analyzer for Splunk – Getting Started

Too many times we have situations we suffer from random network connection / latency problems which might be caused by a huge amount of traffic sent over the network or even a problem directly on the specific endpoints.

If you have such kind of problems, in the most of the cases it’s mandatory to capture network traffic on the affected endpoints or even better also on a network device in the middle.

The most popular tool to analyze network captures (.pcap files) is Wireshark.
There are many good tutorials in the Internet which shows good ways to understand and finding the root cause for such Incidents.
I am using Wireshark since more or less 4 years now and after that time and also after many network trace files I’ve looked in there are some features which are not included or hard to get out of Wireshark (e.g. Top Talker Conversations over time, Number of devices between the conversation endpoints).

So I started to think about a way to collect the network packet data by using Splunk. After several weeks checking which will be the best way I’ve decided to use the CSV functionality.
Wireshark includes several sub components including the tshark component which is able to convert the .pcap file to a Splunk readable CSV file.

I came up with the “PCAP Analyzer for Splunk” which can be downloaded from Splunk App page:
https://splunkbase.splunk.com/app/2748/

How to get started?

“PCAP Analyzer for Splunk” requires a full splunk instance running on *nix / Windows systems and Wireshark needs to be installed.
In summary the most important requirements are the following:

• Splunk instance with SPLUNK_HOME variable defined.
• Wireshark installed (on Windows: Wireshark needs to be located at %programfiles%)
• Confirm that your user has all administrative privileges for the folders “$SPLUNK_HOME/etc/apps/SplunkForPCAP/bin/” and for your Wireshark folder.

What’s next?

As soon as you have installed the “PCAP Analyzer for Splunk” on your Splunk instance the next step is to define a folder on your system which should be monitored for “*.pcap” files.
You can define this folder in the WebUI via Settings –> Data Inputs –> PCAP File Location.

In this configuration panel you have to define a name and a path.
Lets make an example and use as name “myfolder” and as path “/var/tmp/”.

With this configuration a new folder will be created automatically at “$SPLUNK_HOME/etc/apps/SplunkForPCAP/”. It is the “local” folder which includes an “inputs.conf” file.

How to get my first “.pcap” file into Splunk?

If you can confirm that the above steps has been done successful, the next step is to put a “*.pcap” file in your folder you have defined (e.g. /var/tmp/).
Now the rest is done by the app.

“PCAP Analyzer for Splunk” checks every 3 minutes if a new pcap file has been added to your folder.
If it finds a new pcap file it will be converted and indexed automatically into Splunk.

You can open a panel in the application and you should find your pcap file in the dropdown menu.

Good things to know!

• As soon as your “*.pcap” file is processed, it will be moved to “$SPLUNK_HOME/etc/apps/SplunkForPCAP/PCAPConverted”. No need to worry 🙂
• Your files will be converted to a CSV file which are created in the folder “$SPLUNK_HOME/etc/apps/SplunkForPCAP/PCAPcsv”. You can delete those file after the indexing is done.

Summary

The tool helps me to understand details about each pcap file and you can even use it with the free version of Splunk on your workstation. When I receive a file to analyze, it will take 2 minutes to have the file converted into Splunk. Follow those steps and everything is set up properly.

If you want to know more about it, join my Slack Workspace or send me an email.
Stay up-to-date and subscribe to my Newsletter!