Looking for ICMP in Stream?

[AzJimbo]

Trying to see if I can get ICMP in Stream. Any suggestions? Don't want to go the pdml parser route if I can tease it out of already installed Stream app.

[dcavuto_splunk]

It's a good point, AzJimbo. I'm the new Product Manager for Stream, and I appreciate your feedback!

I'll take a look at the backlog and see if we can prioritize ICMP in an upcoming Stream release.

Thanks!
-David

[AzJimbo]

Awesome! Stream app 6.6.0 now has ICMP. Thank you.

[mdickey_splunk · Accepted solution]

ICMP is not currently supported by stream; however, it is on our list of protocols to add for a future release.

[AzJimbo]

Thanks- I'm look to use it to enhance security analysis.

[AzJimbo]

Sooooo..... it's been a couple of years; but I still don't see ICMP in the Stream App? I'm currently running nfdump just so I can get the ICMP, but would much rather use just the Stream app. Looking to detect and alert on icmp tunneling, a method to stealthy exfil data out of a compromised network. (http://www.cs.uit.no/~daniels/PingTunnel/) .