131.25. Packet Capture (im_pcap)

Table of Contents

This module provides support to passively monitor network traffic by generating logs for various protocols. It uses the libpcap and winpcap libraries to capture network traffic.

Note	Multiple instances of im_pcap are not supported currently.

131.25.1. Configuration

The im_pcap module accepts the following directives in addition to the common module directives.

Dev: This optional directive can only occur once. It specifies the name of a network device/interface on which im_pcap will capture packets. This directive is mutually exclusive with the File directive.

Fields: The names of protocol fields to be included in the output. If no field names are present in the protocol configuration then all fields for the protocol will be present in the output. If any field names are present in the configuration for a protocol, then only those named fields will be present in the output. Refer to NXLog Pcap Protocols for details of the fields supported for each protocol.

File: This optional directive can only occur once. It specifies the path to the file which contains capture packet data. The file path do not need to be enclosed in quotation marks, although both single quoted and double quoted paths are accepted. This directive is mutually exclusive with the Dev directive.

Protocol

This is an optional group directive. It specifies the protocol, port number and protocol-specific fields which should be captured. May be used multiple times in the module definition, to specify multiple protocols. If no Protocol directive is specified, then all protocols will be captured. It has the following sub-directives:

Type

Defines the name of a protocol to capture. Allowed types are; ethernet, ipv4, ipv6, ip, tcp, udp, http, arp, vlan, icmp, pppoe, dns, mpls, gre, ppp_pptp, ssl, sll, dhcp, null_loopback, igmp, vxlan, sip, sdp, radius, modbus, profinet, dnp3, bacnet, iec104.

Port

A list of custom port numbers to capture for the protocol specified in the Type directive. If omitted, standard port number(s) corresponding to the protocol will be used. Refer to NXLog Pcap Protocols for details of the default ports for each protocol.

Note	The list of port numbers must be separated by a comma. Spaces and tabs between the values are accepted.

Filter

An optional directive that defines a filter, which can be used to further limit the packets that should be captured and handled by the module. Filters do not need to be enclosed in quotation marks, although both single quoted and double quoted filters are accepted. If this directive is not used, then no filtering will be done.

Note	Filtering is done by the `libpcap` library. See the Manpage of PCAP-FILTER in the libpcap documentation for the syntax. Not all protocols are supported for libpcap filtering.

131.25.2. Examples

Example 722. Reading from a PCAP File While Applying a Packet Filter

In this example, the File directive defines the path and filename of a .pcap file containing packets saved by Wireshark. The Filter directive defines a filter that selects only TCP packets targeted for port 443. The output is formatted as JSON while written to file.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

  <Extension _json>
    Module  xm_json
</Extension>

<Input pcap>
    Module    im_pcap
    File      "/tmp/example.pcap"
    Filter    tcp dst port 443
</Input>

<Output file>
    Module  om_file
    File    "/tmp/output.json"
    Exec    to_json();
</Output>

Example 723. Capturing TCP, Ethernet, and HTTP Traffic to a Single File

In this example, the configuration illustrates how the Protocol group directive can be defined multiple times within the same module instance. Three types of network packets are to be captured: HTTP requests; TCP for the source and destination ports of all visible TCP traffic; and Ethernet to log the MAC addresses of packet sources and their destinations. The events are formatted to JSON while writing to a file.

This approach has two distinct advantages. It produces events that include all fields of all three protocols, which enables correlation between protocols that yield source and destination information with those protocols that do not provide such fields. Additionally, it achieves this goal using a single module instance instead of multiple instances, which reduces system resource consumption.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

  <Extension _json>
    Module  xm_json
</Extension>

<Input pcap>
    Module  im_pcap
    Dev     any
    <Protocol>
        Type    http
        Field   http.request.uri
        Field   http.request.method
        Field   http.response.code
        Field   http.response.phrase
    </Protocol>
    <Protocol>
        Type    tcp
        Field   tcp.src_port
        Field   tcp.dst_port
        Field   tcp.flag
    </Protocol>
    <Protocol>
        Type    ethernet
        Field   eth.src_mac
        Field   eth.dest.mac
    </Protocol>
</Input>

<Output file>
    Module  om_file
    File    "tmp/output"
    Exec    to_json();
</Output>

Example 724. Capturing TCP, Ethernet, and HTTP Traffic to Separate Files

In this example, each of the three protocols are managed by a separate module instance. The events are formatted to JSON while being written to each of their respective files. This approach can be used when there is a need to analyze each protocol in isolation from each other. Because three input instances are used, more system resources will be consumed when compared to the multi-protocol, single-instance approach.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

  <Extension _json>
    Module  xm_json
</Extension>

<Input pcap_tcp>
    Module  im_pcap
    Dev     any
    <Protocol>
        Type    tcp
        Field   tcp.src_port
        Field   tcp.dst_port
        Field   tcp.flag
    </Protocol>
</Input>

<Input pcap_http>
    Module  im_pcap
    Dev     any
    <Protocol>
        Type    http
        Field   http.request.uri
        Field   http.request.method
        Field   http.response.code
        Field   http.response.phrase
    </Protocol>
</Input>

<Input pcap_eth>
    Module  im_pcap
    Dev     any
    <Protocol>
        Type    Ethernet
        Field   eth.src_mac
        Field   eth.dest.mac
    </Protocol>
</Input>

<Output tcp_file>
    Module  om_file
    File    "tmp/tcp_output"
    Exec    to_json();
</Output>

<Output http_file>
    Module  om_file
    File    "tmp/http_output"
    Exec    to_json();
</Output>

<Output eth_file>
    Module  om_file
    File    "tmp/eth_output"
    Exec    to_json();
</Output>

You are here

131.25. Packet Capture (im_pcap) | Log Collection Solutions