Sign in

v1

latestOpenAPI 3.1.0Elastic 2.02026-07-179371211.2 KB
Jobs

Get PCAP Packets

Retrieves the packets collected and attached to the job represented by the given job ID. This request assumes the job is a PCAP job.

get/connect/packets/{jobId}

Path parameters

jobIdinteger required

The job ID

Query parameters

unwrapboolean

If true, and if the stream data is eligible the stream data will be unwrapped. An example of wrapped stream data is VXLAN packet data.

offsetinteger

The starting offset of the packet to retrieve; used for paging large packet results. Defaults to 0.

countinteger

The maximum number of packets to retrieve; used for paging large packet results. Defaults to 5000, or an optional server-side configuration value/

Response

The array of retrieved Packet objects

acknowledgeinteger

An optional packet sequence number this packet is acknowledging having been received

checksuminteger

The packet checksum value, used for integrity checking

dstIpstring

The packet destination IP address

dstMacstring

The packet destination MAC address

dstPortinteger

The packet destination port

flagsstring[]

The optional packet flags. Ex: SYN PSH FIN

lengthinteger

The size of the packet, including headers.

numberinteger

The sequential packet number in the packet stream

payloadstring

The packet payload base64-encoded bytes

payloadOffsetinteger

The offset in the packet payload where the application-specific payload begins, if an application payload is applicable to this packet.

sequenceinteger

This packet's sequence number

srcIpstring

The packet source IP address

srcMacstring

The packet source MAC address

srcPortinteger

The packet source port

timestampstring

The timestamp when the packet was captured

typestring

The packet type. Note that Security Onion only supports specific packet types in the PCAP retrieval and viewing system.

windowinteger

The packet window size

Example response

[
  {
    "acknowledge": 1400892081,
    "checksum": 4868,
    "dstIp": "41.51.61.71",
    "dstMac": "a0:b1:c2:d3:e4:f5",
    "dstPort": 55423,
    "flags": [
      "SYN",
      "ACK"
    ],
    "length": 79,
    "payload": "oDaf1FD=",
    "sequence": 2023436470,
    "srcIp": "1.2.3.4",
    "srcMac": "0a:1b:2c:3d:4e:5f",
    "srcPort": 80,
    "timestamp": "2024-10-06T19:29:39.332211Z",
    "type": "DNS",
    "window": 64296
  }
]