PCAP Decode

PCAP Decode (pcap-decode)

Decode pcap or pcapng binary payloads into per-packet JSON events.

Transform binary json

Minimal example

actions:
  - pcap-decode: {}

JSON

{
  "actions": [
    {
      "pcap-decode": {}
    }
  ]
}

Contents

• Minimal example

• Decoding

• General

• Limits

• Output

• Schema

A ✓ marks a field that accepts a context variable such as {{ VARIABLE }}.

Decoding

Decoding

Field	Type	Required	Description
link-type-mode	Link Type Mode		How unsupported link types are handled: best-effort or strict. Allowed values: best-effort, strict

General

General

Field	Type	Required	Description
description	string		Short summary displayed in the editor.
condition	lua-expression (string)		Conditional expression that gates whether decoding runs. Examples: 2 * count()

Limits

Limits

Field	Type	Required	Description
packet-limit	number (integer)		Optional maximum number of packets to emit from a capture. Examples: 42, 1.2e-10

Output

Output

Field	Type	Required	Description
include-packet-metadata ✓	boolean (bool)		Retain stable per-packet metadata under _pcap. Default: false
include-raw-bytes ✓	boolean (bool)		Include base64-encoded raw packet bytes under _pcap.packet_bytes_b64. Default: false

Schema

• Link Type Mode Options

Link Type Mode Options

Value	Aliases	Name	Description
best-effort		best-effort
strict		strict