Automate bulk export of PCAPs with Trisul
We recently had an incident where TRP Scripting came to our rescue. I just want to share this with other Trisul users who might want to look at automation of Network and Security Monitoring more.
The customer is a cloud provider who has been running Trisul for a few months now. There was an incident this past week and their team asked us if they could get the following data out of Trisul.
Can I have PCAPs for this host from Jan 2014 – one per day ?
Now you can easily get them a days worth of PCAP from the web UI by Retro → Retro Tools → Pull Packets But try doing this 31 times, one for each day in January. This is tedious work. So we quickly wrote up a tiny script in Ruby using the trisulrp gem to accomplish the task.
The daypcaps.rb script prompts you for a month and saves each days packets neatly into a separate PCAP file.
Here is a sample run
[tuser@rack600126 trp]$ ruby daypcaps.rb 192.168.1.22 12001 Enter PEM pass phrase: Enter month (YYYY-MM) : 2014-01 Processing Date = 2014-01-01 Finished Date = 2014-01-01 Number of bytes = 0 Number of pkts = 0 Hash = ec1964c9934fe5016880edef804c488c1f96c21e Saved pcap file on server = /tmp/TFILT-15864-1392897226.pcap Processing Date = 2014-01-02 Finished Date = 2014-01-02 Number of bytes = 1047657843 Number of pkts = 1552787 Hash = 1f6bffb04553ac53103f423711ee0084b238325b Saved pcap file on server = /tmp/TFILT-15864-1392897228.pcap Processing Date = 2014-01-03 Finished Date = 2014-01-03 Number of bytes = 859401629 Number of pkts = 1321092 Hash = d265cfefc4057843635be0c330321ffef14380ad Saved pcap file on server = /tmp/TFILT-15864-1392897401.pcap Processing Date = 2014-01-04 Finished Date = 2014-01-04 Number of bytes = 142425149 Number of pkts = 247244 Hash = 8d3a064559fabff5d00d9e2bc1fa9c638289d5f2 Saved pcap file on server = /tmp/TFILT-15864-1392897539.pcap
This illustrates the real world benefits that the Trisul Remote Protocol enables. We encourage more of our users to explore it. It only needs a wee bit of knowledge of Ruby.
Free Download Trisul 4.0 is just around the corner. Get the early builds here.