How to load PCAP format data

My prospect wants to load PCAP data. Could you share the tips to load the data into Vertica?


  • Jim_KnicelyJim_Knicely - Select Field - Administrator
    edited June 2018


    pcap files have their own proprietary format:

    [dbadmin@s18384357 pcap]$ file ipv4frags.pcap
    ipv4frags.pcap: tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 2000)

    I would just convert the pcap files to csv using tshark and load those into Vertica :)


    [dbadmin@s18384357 pcap]$ vsql -c "create flex table pcap();"
    [dbadmin@s18384357 pcap]$ tshark -r ipv4frags.pcap -T fields -e frame.number -e eth.src -e eth.dst -e ip.src -e ip.dst -e frame.len -E header=y -E separator=, | vsql -c "copy pcap from stdin parser fcsvparser();"
    [dbadmin@s18384357 pcap]$ vsql -c "select compute_flextable_keys_and_build_view('pcap');
    [dbadmin@s18384357 pcap]$ vsql -c "select compute_flextable_keys_and_build_view('pcap');"
     Please see public.pcap_keys for updated keys
    The view public.pcap_view is ready for querying
    (1 row)
    [dbadmin@s18384357 pcap]$ vsql -c "select * from pcap_view;"
          eth.dst      |      eth.src      | frame.len | frame.number | ip.dst  | ip.src
     08:00:27:e2:9f:a6 | 08:00:27:fc:6a:c9 |      1010 |            1 | |
     08:00:27:e2:9f:a6 | 08:00:27:fc:6a:c9 |       466 |            2 | |
     08:00:27:fc:6a:c9 | 08:00:27:e2:9f:a6 |      1442 |            3 | |
    (3 rows)
  • KaitoKaito Employee

    Thank you, Jim!

Leave a Comment

BoldItalicStrikethroughOrdered listUnordered list
Align leftAlign centerAlign rightToggle HTML viewToggle full pageToggle lights
Drop image/file