AppPacCap

Application Packet Capture: A better way to PCAP.

API

AppPacCap provides a RESTful API that allows for control of the packet capture process as well as the visualization of the data. This powerful back-end functionailty can be used to create useful and functional front-ends that meet specific needs. Here you can explore the RESTful API.

AJAX

The API is accessed by performing a POST to the url ajax. The parameter action is required and the rest of this document discusses the various action values. If authentication is enabled then token is also required. token can be set through placeholders that AppPacCap will replace when the page is served. It is important to place the placeholder as the first argument as AppPacCap includes a comma in the replaced value. The token placeholders can be viewed here and an example of a request with the token placeholder can be seen below.

AJAX Call

                  
var ax = $.ajax({
  url: "ajax",
  type: "post",
  data: { {%HD_AJAX_TOKEN} "action": "action_value", ... }
});
                  
              

apppaccap

This command is used to query information about the current AppPacCap installation.

Parameters

                  
none
                  
                

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = APPPACCAP
                  
                

action_add

This command is used to add a new action. Parameters are variable based on the action type.

Parameters

                  
token
name
action_type
trigger_id
...
ACTION_TYPE_EXECUTE
  path
  params
ACTION_TYPE_EXPORT
  path
                  
                

• token: (optional) The token value that gets returned during login.
• name: Name of the action..
• action_type: Type of action..
• trigger_id: (optional) If set, this action will only apply to the specified trigger. If undefined or 0, then the action will apply system wide.
• ACTION_TYPE_EXECUTE
  • path: Program path to execute.
  • params: (optional) Parameters that are passed to the process.
  • NOTE: The process will execute in session 0 with service level privileges.
• ACTION_TYPE_EXPORT
  • path: Directory of where to write the export.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = ACTION
                  
                

action_clear_triggers

This command is used to clear associated triggers.

Parameters

                  
token
action_id
                  
                

• token: (optional) The token value that gets returned during login.
• action_id: The action id.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

action_list

This command is used to list all configured actions.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf ACTION
                  
                

action_mod

This command is used to modify an existing action.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

action_remove

This command is used to delete an action.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

action_set_trigger

This command is used set associated triggers.

Parameters

                  
token
action_id
trigger_id
                  
                

• token: (optional) The token value that gets returned during login.
• action_id: The action id.
• trigger_id: (optional) The trigger id to associate with the action. If 0, existing triggers will be cleared and the action will be set to system wide. Otherwise, the trigger will be added to the list.

adapter_list

This command is used to list all network adapters.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf NETADAPTER
                  
                

apc_flush

This command is used to delete saved data. No active capture sessions can be running when issuing this command.

Parameters

                  
token
flags
                  
                

• token: (optional) The token value that gets returned during login.
• flags: The flag value indicates what data should be flushed from the databases. The flag values are defined here.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INTEGER
ReturnValue = ERROR_SUCCESS
                  
                

capture_conn_stream

This command is used to query packets associated with a specific connection id.

Parameters

                  
token
capture_id
conn_id
flags
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.
• conn_id: Connection id.
• flags: Default is 0 which means only packet meta-data is returned. Set to 1 if packet bytes should be included.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = PACKETSTREAM
                  
                

capture_delete

This command will delete a completed capture to include all packet data written to the database.

                  
token
capture_id
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

capture_export

This command is used to request an export of packet data to a PCAPNG file.

Parameters

                  
token
capture_id
path
filter
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.
• path: (optional) The full file path to write the exported data to. If blank, will write to the export directory in the installation folder.
• filter: (optional) A filter string to limit what packets get exported.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = COMMAND
                  
                

capture_get_details

This command is used to get details about a capture session.

Parameters

                  
token
capture_id
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = CAPTURE
                  
                

capture_get_packet

This command is used to get the packet bytes.

Parameters

                  
token
capture_id
packet_id
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.
• packet_id: Packet id.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = PACKET
                  
                

capture_get_processes

This command is used to get a list of processes associated with a capture session.

Parameters

                  
token
capture_id
last_id
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.
• last_id: (optional) The id value to query from. Default is 0.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf PROCESS
                  
                

capture_list_active

This command is used to list all active capture sessions.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf CAPTURE
                  
                

capture_list_conns

This command is used to get a list of connetions associated with a capture session.

Parameters

                  
token
capture_id
last_id
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.
• last_id: (optional) The id value to query from. Default is 0.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf CONNECTION
                  
                

capture_list_completed

This command is used to list all completed capture sessions.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf CAPTURE
                  
                

capture_list_system

This command is used to list just completed system captures.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf CAPTURE
                  
                

capture_open

This command is used to open a completed capture for reading and querying. It will fail if an active capture id is passed.

Parameters

                  
token
capture_id
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = CAPTUREMETA
                  
                

capture_query_ip

This command is used to query unique IP addresses associated with a capture session.

Parameters

                  
token
capture_id
last_id
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id. If 0, then the system wide IP list is queried.
• last_id: The last IP id to query from. Default is 0.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf IP
                  
                

capture_read

This command is used to read packet data from a completed session.

Parameters

                  
token
capture_id
last_id
flags
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.
• last_id: (optional) The last packet id to query from. Default is 0.
• flags: (optional) Currently only supports 0 or 1. If set to 1, the packet bytes will be returned with the query otherwise it is just the metadata.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = PACKETSTREAM
                  
                

capture_set_notes

This command is used to associate user-defined metadata with either a capture session or individual packets.

Parameters

                  
token
capture_id
packet_id
notes
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.
• packet_id: (optional) The packet id to update. If 0 or empty, then the capture session metadata will be updated.
• notes: (optional) The metadata to set. If blank or missing then the metadata is cleared.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INTEGER
ReturnValue = ERROR_SUCCESS
                  
                

capture_start_system

This command is used to start a system wide packet capture.

Parameters

                  
token
filter
flags
adapter
                  
                

• token: (optional) The token value that gets returned during login.
• filter: (optional) A filter string. If provided, only the packets that match will be saved.
• flags: (optional) Flags that control how the capture session works. Default is 0. Only supports CAPTURE_FLAG_RESOLVE_IPS.
• adapter: (optional) List of adapter names to capture from. If empty then all adapters will be monitored.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = CAPTURE
                  
                

capture_stop_system

This command is used to stop an active system-wide capture session.

Parameters

                  
token
capture_id
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: The capture id of the system capture session to stop.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

capture_start_process

This command is used to start a packet capture targeted against a specific process.

Parameters

                  
token
capture_id
process_id
pid
thread_id
filter
flags
adapter
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.
• process_id: Process id.
• pid: System process id.
• thread_id: (optional) The specific thread to capture. Must include CAPTURE_FLAG_THREAD_CAPTURE in flags if thread is targeted.
• filter: (optional) A filter string. If provided, only the packets that match will be saved.
• flags: (optional) Flags that control how the capture session works. Default is 0.
• adapter: (optional) List of adapter names to capture from. If empty then all adapters will be monitored.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = CAPTURE
                  
                

capture_stop_all

This command is used to stop all active capture sessions.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

capture_stop_process

This command is used to stop an active non-system capture session.

Parameters

                  
token
capture_id
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

capture_stream

This command is used to request packet data associated with a capture session. This command only works with active captures and will fail with completed sessions.

Parameters

                  
token
capture_id
last_id
flags
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.
• last_id: (optional) The last packet id to query from. Default is 0.
• flags: (optional) Currently only supports 0 or 1. If set to 1, the packet bytes will be returned with the query otherwise it is just the metadata.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = PACKETSTREAM
                  
                

capture_thread_stream

This command is used to request packets associated with a specific process and thread.

Parameters

                  
token
capture_id
pid
thread_id
flags
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.
• pid: System process id.
• thread_id: System thread id (tid).
• flags: (optional) Currently only supports 0 or 1. If set to 1, the packet bytes will be returned with the query otherwise it is just the metadata.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = PACKETSTREAM
                  
                

command_delete

This command is used to delete a command.

Parameters

                  
token
command_uid
                  
                

• token: (optional) The token value that gets returned during login.
• command_uid: The uid of the command to delete.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

command_list

This command is used to list all commands.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf COMMAND
                  
                

command_query

This command is used to query the status of a command.

Parameters

                  
token
command_uid
                  
                

• token: (optional) The token value that gets returned during login.
• command_uid: The uid of the command to query.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = COMMAND
                  
                

export_list

This command is used to list all of the exported PCAP files.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = EXPORTFILE
                  
                

export_delete

This command is used to delete one or all exported PCAP files.

Parameters

                  
token
filename
                  
                

• token: (optional) The token value that gets returned during login.
• filename: (optional) The filename of the PCAP to delete. If missing or blank, then all PCAP files will be deleted.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = The number of files deleted
                  
                

extract_enable

This command is used to turn on file extraction. This is a global flag that impacts all capture sessions. Enabling file extraction can add significant overhead to the capture process.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

extract_disable

This command is used to turn off file extraction. This is a global flag that impacts all capture sessions.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

extract_query

This command is used to query the detected files that can be extracted from a capture session.

Parameters

                  
token
capture_id
last_id
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: The capture session id to query.
• last_id: (optional) The last file extraction id to query from.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = EXTRACTSTREAM
                  
                

extract_file_write

This command is used to actually extract the file from the packets and write it to disk.

Parameters

                  
token
capture_id
stream_id
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: The capture session id to query.
• stream_id: The stream id within the capture session that represents the file.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = EXTRACTFILE
                  
                

extract_file_list

This command is used to query all extracted files on disk.

Parameters

                  
token
capture_id
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: The capture session id to query.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf EXTRACTFILE
                  
                

extract_file_clear

This command is used to delete all extracted files from disk.

Parameters

                  
token
capture_id
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: The capture session id to query.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = The number of files deleted
                  
                

extract_file_delete

This command is used to delete a specific extracted file.

Parameters

                  
token
capture_id
file_id
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: The capture session id to query.
• file_id: (optional) The id of the file to delete. If missing or zero, then all files are deleted.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = The number of files deleted
                  
                

ip_query

This command is used to query information on an IP address.

Parameters

                  
token
capture_id
ip
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: (optional) Capture session to query the data from. If zero, then the global list will be used.
• ip: IP address to query.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = IP
                  
                

ip_set_data

This command is used to store the any additional meta data associated with an IP address.

Parameters

                  
token
capture_id
ip
data
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: (optional) Capture session to update in addition to the global list.
• ip: The IP address being saved.
• data: (optional) The data to associate with an ip. If blank then then existing data is cleared.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

ip_set_geo

This command is used to store the geolocation data for an IP address if resolved through an external system.

Parameters

                  
token
capture_id
ip
hostname
country
city
lat
lng
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: (optional) Capture session to update in addition to the global list.
• ip: The IP address being saved.
• hostname: (optional) The associated hostname.
• country: (optional) The country the IP is located in.
• city: (optional) The city the IP is located in.
• lat: The latitude of the IP address location.
• lng: The longitude of the IP address location.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

monitor_start

This command is used to set an adapter in monitor mode. This only works for WiFi adapters that support monitor mode.

Parameters

                  
token
tap_id
                  
                

• token: (optional) The token value that gets returned during login.
• tap_id: Adapter id.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

monitor_stop

This command is used to turn off monitor mode for an adapter. This only works for WiFi adapters that support monitor mode.

Parameters

                  
token
tap_id
                  
                

• token: (optional) The token value that gets returned during login.
• tap_id: Adapter id.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

pcap_ingest_file

This command is used to send a PCAP filename to AppPacCap so it can be ingested.

Parameters

                  
token
path
                  
                

• token: (optional) The token value that gets returned during login.
• path: The file path of the PCAP or PCAPNg file.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

pcap_ingest_post

This command is used to send a PCAP file through a form POST so it can be ingested.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

process_list_capture

This command is used to list all processes currently being captured.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf PROCESS
                  
                

process_list_running

This command is used to list all currently running processes.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf PROCESS
                  
                

process_list_threads

This command is used to list the threads associated with a process.

Parameters

                  
token
process_id
pid
flags
                  
                

• token: (optional) The token value that gets returned during login.
• process_id: The process id.
• pid: The system process id.
• flags: (optional) Returns all process threads if set to 1. Default is 0 which returns only live threads.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf THREAD
                  
                

search_cancel

This command is used to cancel a search operation.

Parameters

                  
token
search_id
                  
                

• token: (optional) The token value that gets returned during login.
• search_id: The id of the search operation to cancel.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

search_delete

This command is used to cancel an active search (if running), and delete all results.

Parameters

                  
token
search_id
                  
                

• token: (optional) The token value that gets returned during login.
• search_id: The id of the search operation to delete.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

search_export

This command is used to request an export of packet data to a PCAPNG file.

Parameters

                  
token
search_id
path
                  
                

• token: (optional) The token value that gets returned during login.
• search_id: Search id.
• path: (optional) The full file path to write the exported data to. If blank, will write to the export directory in the installation folder.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = COMMAND
                  
                

search_list

This command is used to list all active and completed searches.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf SEARCHMETA
                  
                

search_open

This command is used to get information about a specific search request.

Parameters

                  
token
search_id
                  
                

• token: (optional) The token value that gets returned during login.
• search_id: The id of the search operation.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = SEARCHMETA
                  
                

search_read

This command is used to query the results of a specific search operation and to retrieve results.

Parameters

                  
token
search_id
last_id
                  
                

• token: (optional) The token value that gets returned during login.
• search_id: The id of the search operation.
• last_id: (optional) The last search item id to query from. Default is 0..

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = SEARCHLIST
                  
                

search_start

This command is used to begin a search operation. Searches are async so results are not returned with this command.

Parameters

                  
token
filter
                  
                

• token: (optional) The token value that gets returned during login.
• q: The search filter.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = SEARCHMETA
                  
                

search_verify_filter

This command is used to verify if a search filter syntax is correct.

Parameters

                  
token
filter
                  
                

• token: (optional) The token value that gets returned during login.
• filter: The search filter string to verify.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = SEARCHSYNTAX
                  
                

server_folders

This command is used to query all installed themes.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf (string)
                  
                

server_pages

This command is used to query all pages associated with a specific theme.

Parameters

                  
token
theme_name
                  
                

• token: (optional) The token value that gets returned during login.
• theme_name: Name of theme query available pages.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf (string)
                  
                

settings_clear

This command is used to clear all user defined settings.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

settings_get_all

This command is used to get all user defined settings.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = dictionaryOf (string, string)
                  
                

settings_get_by_key

This command is used to query a specific setting by key name.

Parameters

                  
token
key_name
                  
                

• token: (optional) The token value that gets returned during login.
• key_name: Name of settings key.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_STRING
ReturnValue = value
                  
                

settings_set

This command is used to set a settings value by key name.

Parameters

                  
token
key_name
value
                  
                

• token: (optional) The token value that gets returned during login.
• key_name: Name of settings key to set.
• value: Value to associate with key_name.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

stats_by_date

This command is used to date specific statistics.

Parameters

                  
token
capture_id
start_dtg
end_dtg
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.
• start_dtg: Start of date range in UTC filetime.
• end_dtg: (optional) End of date range in UTC filetime.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = STATSCAPTUREQUERY
                  
                

stats_by_id

This command is used to query capture specific statistics.

Parameters

                  
token
capture_id
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = STATSCAPTUREQUERY
                  
                

stats_by_ip

This command is used to query IP specific statistics.

Parameters

                  
token
capture_id
ip
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.
• ip: IP address to query.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = STATSCAPTUREQUERY
                  
                

stats_by_port

This command is used to query port specific statistics.

Parameters

                  
token
capture_id
port
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.
• port: Port number to query.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = STATSCAPTUREQUERY
                  
                

stats_by_protocol

This command is used to protocol specific statistics.

Parameters

                  
token
capture_id
protocol
                  
                

• token: (optional) The token value that gets returned during login.
• capture_id: Capture id.
• protocol: Layer 3 protocol number.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = STATSCAPTUREQUERY
                  
                

stats_reset

This command is used to reset the statistic counters.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

stats_totals

This command is used to query system wide statistics.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = STATSQUERY
                  
                

trigger_add

This command is used to add a new trigger. Parameters are variable based on the trigger type.

Parameters

                  
token
name
trigger_type
...
TRIGGER_TYPE_ON_START
  path
  filter
  flags
                  
                

• token: (optional) The token value that gets returned during login.
• name: The name of the trigger..
• trigger_type: Type of trigger..
• TRIGGER_TYPE_ON_START
  • path: Directory or process path to trigger on.
  • filter: (optional) Filter string applied to any capture session started with this trigger.
  • flags: (optional) Flags that control how the capture session works. Default is 0.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

trigger_clear_actions

This command is used to clear all associated actions.

Parameters

                  
token
trigger_id
                  
                

• token: (optional) The token value that gets returned during login.
• trigger_id: Trigger id.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

trigger_get_actions

This command is used to get the list of actions associated with this trigger.

Parameters

                  
token
trigger_id
                  
                

• token: (optional) The token value that gets returned during login.
• trigger_id: Trigger id.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf ACTION
                  
                

trigger_set_action

This command is used to set an action to the trigger.

Parameters

                  
token
trigger_id
action_id
                  
                

• token: (optional) The token value that gets returned during login.
• trigger_id: Trigger id.
• action_id: Action id to set

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

trigger_list

This command is used to list all configured triggers.

Parameters

                  
token
                  
                

• token: (optional) The token value that gets returned during login.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_JSON
ReturnValue = listOf TRIGGER
                  
                

trigger_mod

This command is used to modify an existing trigger.

Parameters

                  
token
trigger_id
filter
flags
                  
                

• token: (optional) The token value that gets returned during login.
• trigger_id: Trigger id.
• filter: (optional) Filter string applied to the capture session started with this trigger. Will clear filter if blank or empty.
• flags: Flags that control how the capture session works.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS
                  
                

trigger_remove

This command is used to delete a trigger.

Parameters

                  
token
trigger_id
                  
                

• token: (optional) The token value that gets returned during login.
• trigger_id: Trigger id.

On Success Returned Data

                  
ErrorCode = ERROR_SERVE_SUCCESS
DataType = DATA_TYPE_INT
ReturnValue = ERROR_SUCCESS