Archive

App for Stream - pcap replay

Path Finder

I have a pcap with DNS traffic that I want to analyze. I downloaded the 'Stream Examples' app and the main Splunk App for Stream. There is a Stream Replay input option which I pointed at my .pcap but I don't see any data. I have the 'streamfwd' enabled and I don't see any data related to that either. I followed the Install guide for all this so I am not sure what else to do here.

Any help or troubleshooting options would be helpful.

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Were you able to edit the streamfwd.xml config file in the local directory for your Splunk Stream instance? Check out this link, it goes over setting up Splunk Stream to look at a specific PCAP file : https://answers.splunk.com/answers/220040/running-stream-against-old-pcaps.html

I hope that helps!

0 Karma

Splunk Employee
Splunk Employee

What operating system are you running?

0 Karma

Path Finder

Red Hat Enterprise Linux Server release 5.7 (Tikanga)

0 Karma

Splunk Employee
Splunk Employee

Should work. There's a long list of questions about your environment we need to ask to help troubleshoot. Given the amount of detailed work that needs to happen, support is probably a better option than Answers.

0 Karma

Path Finder

I will contact support. The environment is straightforward VM install with a base splunk install I use for importing logs to troubleshoot.

0 Karma

Splunk Employee
Splunk Employee

What link layer your pcap file has? App for Stream only support ethernet, linux cooked sockets and DLT_NULL link types. Wireshark should be able to tell you the link type; you may also want to look for "SnifferReactor unrecognized link layer for device " error messages in the streamfwd.log file

0 Karma