Splunk Search

App for Stream - pcap replay

sswansonchtr
Path Finder

I have a pcap with DNS traffic that I want to analyze. I downloaded the 'Stream Examples' app and the main Splunk App for Stream. There is a Stream Replay input option which I pointed at my .pcap but I don't see any data. I have the 'streamfwd' enabled and I don't see any data related to that either. I followed the Install guide for all this so I am not sure what else to do here.

Any help or troubleshooting options would be helpful.

Tags (2)
0 Karma

amiracle
Splunk Employee
Splunk Employee

Were you able to edit the streamfwd.xml config file in the local directory for your Splunk Stream instance? Check out this link, it goes over setting up Splunk Stream to look at a specific PCAP file : https://answers.splunk.com/answers/220040/running-stream-against-old-pcaps.html

I hope that helps!

0 Karma

csharp_splunk
Splunk Employee
Splunk Employee

What operating system are you running?

0 Karma

sswansonchtr
Path Finder

Red Hat Enterprise Linux Server release 5.7 (Tikanga)

0 Karma

csharp_splunk
Splunk Employee
Splunk Employee

Should work. There's a long list of questions about your environment we need to ask to help troubleshoot. Given the amount of detailed work that needs to happen, support is probably a better option than Answers.

0 Karma

sswansonchtr
Path Finder

I will contact support. The environment is straightforward VM install with a base splunk install I use for importing logs to troubleshoot.

0 Karma

vshcherbakov_sp
Splunk Employee
Splunk Employee

What link layer your pcap file has? App for Stream only support ethernet, linux cooked sockets and DLT_NULL link types. Wireshark should be able to tell you the link type; you may also want to look for "SnifferReactor unrecognized link layer for device " error messages in the streamfwd.log file

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...