AppPacCap

Application Packet Capture: A better way to PCAP.

Data Objects

AppPacCap provides a RESTful API that allows for control of the packet capture process as well as the visualization of the data. This powerful back-end functionailty can be used to create useful and functional front-ends that meet specific needs. Here you can explore the data objects returned by AppPacCap.

RESPONSE Object

All data is returned as a JSON object. Every request is wrapped in a RESPONSE object. RESPONSE is defined below:

                  
ErrorCode (int)
DataType (int)
ReturnValue (string)
                  
                

The ErrorCode field is used to indicate success or failure. ErrorCode of zero (0) indicates success while anything greater than zero is an error. Anything less than zero is invalid. Here are some common error code values:

                  
ERROR_SERVE_SUCCESS = 0
ERROR_SERVE_GENERIC_ERROR = 1
ERROR_SERVE_NO_TOKEN = 2
ERROR_SERVE_NO_PAGE = 3
ERROR_SERVE_MALFORMED_REQUEST = 4
ERROR_SERVE_SESSION_TIMEOUT = 5
ERROR_SERVE_INVALID_PERMISSIONS = 8
ERROR_SERVE_INVALID_CREDENTIALS = 9
ERROR_SERVE_INVALID_LICENSE = 12
                  
                

DataType indicates what the ReturnValue represents. Possible options are:

                  
DATA_TYPE_STRING = 1
DATA_TYPE_INT = 2
DATA_TYPE_JSON = 3
DATA_TYPE_HEX = 4
                  
                

All objects start with a Version field. This will be updated if the object structure changes. Please ensure you check this field when processing the object.

APPPACCAP Object

The APPPACCAP object povides information on the current AppPacCap installation. This information can be used to tailor the interface based on the returned values. APPPACCAP is defined below:

                  
Version (int)
AppPacCap (string)
Licensed (int)
LicenseType (string)
MachineName (string)
OS (string)
MapData (int)
Threat (int)
Updated (int)
                  
                

  • Version
    Indicates structure version.
  • AppPacCap
    Provides the current AppPacCap installation version.
  • Licensed
    Indicates if AppPacCap is licensed. 1 if true, 0 if false.
  • LicenseType
    A string representation of the current license.
  • MachineName
    The computer name.
  • OS
    The OS version.
  • MapData
    Indicates if GeoLite2 map data is available. 1 if true, 0 if false.
  • Threat
    Indicates if threat intel URLs have been provided. 1 if true, 0 if false.
  • Updated
    Indicates if AppPacCap was updated the last time it ran. 1 if true, 0 if false.

ACTION Object

The ACTION object is used to represent user defined actions that can be triggered by certain events. ACTION is defined below:

                  
Version (int)
Id (int)
Name (string)
ActionType (int)
Triggers (listOf int)
ModuleName (string)
Path (string)
ImgSrc (string)
Parameters (string)
Flags (int)
                  
                

  • Version
    Indicates structure version.
  • Id
    Action id value used to reference this action where an id value is required.
  • Name
    Action name useful for display purposes.
  • ActionType
    Defines what action should occur.
  • Triggers
    List of associated trigger ids. Count will be zero if is a system wide action.
  • ModuleName
    Executable file name (without path) if defined by the action.
  • Path
    Full file path if defined by the action.
  • ImgSrc
    Relative image source (i.e. /img/icons/...) to executable icon.
  • Parameters
    Parameters to be passed if defined by the action.
  • Flags
    Additional action specific flags.

CAPTURE Object

The CAPTURE object is used to define active capture sessions. CAPTURE is defined below:

                  
Version (int)
CaptureId (int)
ProcessId (int)
Pid (int)
Tid (int)
Filter (string)
TotalPackets (int)
TotalBytes (int)
DTGStart (int)
DTGEnd (int)
IsSystem (int)
ModuleName (string)
Path (string)
ImgSrc (string)
Notes (string)
                  
                

  • Version
    Indicates structure version.
  • CaptureId
    Capture id value used to reference this capture where an id value is required.
  • Pid
    System process id that is being captured. If system capture, this will be 4.
  • Tid
    System thread id that is being captured. If all process threads are being captured, this will be 0.
  • Filter
    The filter string used to filter captured packets. Blank if none provided.
  • TotalPackets
    Total number of packets captured.
  • TotalBytes
    Total bytes of all packets captured.
  • DTGStart
    Start date in UTC filetime.
  • DTGEnd
    End date in UTC filetime. If capture is still active, this will be 0.
  • IsSystem
    1 if is a system wide capture, 0 otherwise.
  • ModuleName
    Executable file name (without path) of the process being captured. If system capture, this will be 'System.'
  • Path
    Full file path of process being captured. If system capture, this will be 'System.'
  • ImgSrc
    Relative image source (i.e. /img/icons/...) to process icon.
  • Notes
    User defined notes about the capture session.

CAPTUREMETA Object

CAPTUREMETA is used to define additional details about the active or closed capture sessions. CAPTUREMETA is defined below:

                  
Version (int)
CaptureId (int)
ProcessId (int)
Pid (int)
Tid (int)
ModuleName (string)
Path (string)
ImgSrc (string)
ParentPid (int)
ParentModuleName (string)
ParentPath (string)
ParentImgSrc (string)
DTGFirst (int)
DTGLast (int)
LastConnectionId (int)
LastIpId (int)
LastPacketId (int)
LastProcessId (int)
TotalPackets (int)
TotalBytes (int)
TotalConnections (int)
                  
                

  • Version
    Indicates structure version.
  • CaptureId
    Capture id value used to reference this capture where an id value is required.
  • ProcessId
    Process id value used to reference this process where an id value is required.
  • Pid
    System process id that is being captured. If system capture, this will be 4.
  • Tid
    System thread id that is being captured. If all threads in a process or is system capture, this will be 0.
  • ModuleName
    Executable file name (without path) of the process being captured. If system capture, this will be 'System.'
  • Path
    Full file path of process being captured. If system capture, this will be 'System.'
  • ImgSrc
    Relative image source (i.e. /img/icons/...) to process icon.
  • ParentPid
    System process id of the parent process. Only valid if capture was triggered by parent.
  • ParentModuleName
    Executable file name (without path) of the parent process. Only valid if capture was triggered by parent.
  • ParentPath
    Full file path of parent process. Only valid if capture was triggered by parent.
  • ParentImgSrc
    Relative image source (i.e. /img/icons/...) to the parent process icon. Only valid if capture was triggered by parent.
  • DTGFirst
    Date in UTC filetime of the first packet captured.
  • DTGLast
    Date in UTC filetime of the last packet captured.
  • LastConnectionId
    ID of the most recent connection. Can be used to query for latest updates.
  • LastIpId
    ID of the most recent IP. Can be used to query for latest updates.
  • LastPacketId
    ID of the most recent packet. Can be used to query for latest updates.
  • LastProcessId
    ID of the most recent process. Can be used to query for latest updates.
  • TotalPackets
    Total number of packets captured.
  • TotalBytes
    Total bytes of all packets captured.
  • TotalConnections
    Total number of connections recorded.

COMMAND Object

The COMMAND object is used to relay status information about pending commands. COMMAND is defined below:

                  
Version (int)
Uid (string)
Command (string)
Status (int)
ErrorCode (int)
Output (string)
DtgAdd (int)
DtgUpdate (int)
                  
                

  • Version
    Indicates structure version.
  • Uid
    Command id string used for reference purposes.
  • Command
    String based value of the requested command.
  • Status
    Commands are not executed right away and are queued up. Status indicates where in the process the command is.
  • ErrorCode
    Provides additional information on success or failure of command.
  • Output
    Command specific output data. For example, could be a filename or process output.
  • DTGAdd
    Date in UTC filetime of when the command was created.
  • DTGUpdate
    Date in UTC filetime of when the command was last updated.

CONNECTION Object

The CONNECTION object provides details about the process that initiated a network connection. CONNECTION is defined below:

                  
Version (int)
Id (int)
Pid (int)
Tid (int)
DTG (int)
SrcIp (string)
SrcPort (int)
DstIp (string)
DstPort (int)
                  
                

  • Version
    Indicates structure version.
  • Pid
    System process id.
  • Tid
    System thread id.
  • DTG
    Date in UTC filetime of when the connection was created.
  • SrcIp
    The source IP.
  • SrcPort
    The source port.
  • DstIp
    The destination IP.
  • DstPort
    The destination port.

EXPORTFILE Object

The EXPORTFILE object defines exported PCAP file metadata. EXPORTFILE is defined below:

                  
Version (int)
FileName (string)
RelativePath (string)
                  
                

  • Version
    Indicates structure version.
  • FileName
    The full file path where the pcap is located on disk.
  • RelativePath
    The relative path of the pcap file.

EXTRACTFILE Object

The EXTRACTFILE object defines extracted file metadata on disk. EXTRACTFILE is defined below:

                  
Version (int)
FileId (int)
FileName (string)
RelativePath (string)
FileType (string)
Size (int)
                  
                

  • Version
    Indicates structure version.
  • FileId
    The file id of the file.
  • FileName
    The full path where the file is located on disk.
  • RelativePath
    The relative path of the file.
  • FileType
    The extension of the file without the period (.).
  • Size
    The size of the file on disk.

EXTRACTSTREAM Object

The EXTRACTSTREAM object defines extracted file stream metadata. EXTRACTSTREAM is defined below:

                  
Version (int)
StreamId (int)
Protocol (int)
FileName (string)
                  
                

  • Version
    Indicates structure version.
  • StreamId
    The stream id of the capture session.
  • Protocol
    Numerical value of the protocol.
  • FileName
    The name of the file pulled from the packet.

IP Object

The IP object defines IP metadata. IP is defined below:

                  
Version (int)
Id (int)
Ip (string)
Country (string)
City (string)
HostName (string)
Lat (decimal)
Lng (decimal)
Data (string)
DTG (int)
                  
                

  • Version
    Indicates structure version.
  • Id
    The id of the IP address.
  • Ip
    The IP address.
  • Country
    Geolocated country.
  • City
    Geolocated city.
  • HostName
    Resolved host name.
  • Lat
    Geolocated latitude.
  • Lng
    Geolocated longitude.
  • Data
    Associated user-defined data.
  • DTG
    Date in UTC filetime of when the IP was first captured.

NETADAPTER Object

NETADAPTER defines network adapters on the system. NETADAPTER is defined below:

                  
Version (int)
Name (string)
Up (int)
MAC (string)
Ip4 (string)
Ip6 (string)
                  
                

  • Version
    Indicates structure version.
  • Name
    Name of the network adapter.
  • Up
    1 indicates the adapter is connected, 0 otherwise.
  • MAC
    MAC address of the adapter.
  • Ip4
    IPv4 address of the adapter.
  • Ip6
    IPv6 address of the adapter.

PACKET Object

The PACKET object provides both metadata about the packet and the actual raw packet bytes. PACKET is defined below:

                  
Version (int)
ConnectionId (int)
Id (int)
DTG (int)
Size (int)
SrcIp (string)
SrcPort (int)
DstIp (string)
DstPort (int)
L2t (int)
L2l (int)
L3t (int)
L3o (int)
L3l (int)
L4t (int)
L4o (int)
L4l (int)
L5o (int)
L5l (int)
HexBytes (string)
Notes (string)
                  
                

  • Version
    Indicates structure version.
  • ConnectionId
    Connection id this packet is associated with.
  • Id
    Packet id that can be used to reference this packet.
  • DTG
    Date in UTC filetime of when the packet was captured.
  • Size
    The number of bytes of the captured packet.
  • SrcIp
    The source IP.
  • SrcPort
    The source port.
  • DstIp
    The destination IP.
  • DstPort
    The destination port.
  • L2t
    Layer 2 header type.
  • L2l
    Layer 2 header length.
  • L3t
    Layer 3 header type.
  • L3o
    Layer 3 header offset.
  • L3l
    Layer 3 header length.
  • L4t
    Layer 4 header type.
  • L4o
    Layer 4 header offset.
  • L4l
    Layer 4 header length.
  • L5o
    Layer 5 header offset.
  • L5l
    Layer 5 header length.
  • HexBytes
    The captured packet in hex format.
  • Notes
    User defined notes about the packet.

PACKETSTREAM Object

The PACKETSTREAM object is used to return a large number of PACKET and PROCCON objects during a query. PACKETSTREAM is defined below:

                  
Version (int)
CaptureId (int)
LastConnectionId (int)
LastIpId (int)
LastPacketId (int)
LastProcessId (int)
Count (int)
Returned (int)
Total (int)
Packets (listOf PACKET)
ProcessConnections (dictionaryOf (int, PROCCON))
                  
                

  • Version
    Indicates structure version.
  • CaptureId
    Capture id these packets are associated with.
  • LastConnectionId
    ID of the most recent connection. Can be used to query for latest updates.
  • LastIpId
    ID of the most recent IP. Can be used to query for latest updates.
  • LastPacketId
    ID of the most recent packet. Can be used to query for latest updates.
  • LastProcessId
    ID of the most recent process. Can be used to query for latest updates.
  • Count
    The number of packets in the list.
  • Returned
    The number of packets before the first one in the list.
  • Total
    The total number of captured packets.
  • Packets
    A list of individual PACKET objects.
  • ProcessConnections
    A dictionary with a key/value pair of {ConnectionId/PROCCON}.

PROCCONN Object

The PROCCONN object provides details about a specific connection. PROCCONN is defined below:

                  
Version (int)
Pid (int)
Tid (int)
Path (string)
ModuleName (string)
ImgSrc (string)
                  
                

  • Version
    Indicates structure version.
  • Pid
    System process id.
  • Tid
    System thread id.
  • ModuleName
    Executable file name (without path) of the process.
  • Path
    Full file path of process.
  • ImgSrc
    Relative image source (i.e. /img/icons/...) to process icon.

PROCESS Object

The PROCESS object provides details about a running or closed process. PROCESS is defined below:

                  
Version (int)
Id (int)
Pid (int)
Threads (listOf int)
ModuleName (string)
Path (string)
ImgSrc (string)
DTGStart (int)
DTGEnd (int)
Captures (int)
                  
                

  • Version
    Indicates structure version.
  • Pid
    System process id.
  • Threads
    A list of all process threads that have associated network activity.
  • ModuleName
    Executable file name (without path) of the process.
  • Path
    Full file path of process.
  • ImgSrc
    Relative image source (i.e. /img/icons/...) to process icon.
  • DTGStart
    Date in UTC filetime of when the process was created.
  • DTGEnd
    Date in UTC filetime of when the process closed. This will be 0 if the process is still running.
  • Captures
    The number of completed captures asosciated with this process.

SEARCHMETA Object

The SEARCHMETA object describes a search query and status. SEARCHMETA is defined below:

                  
Version (int)
Id (int)
Query (string)
FoundCount (int)
Status (int)
ErrorCode (int)
                  
                

  • Version
    Indicates structure version.
  • Id
    The search id.
  • Query
    The submitted query.
  • FoundCount
    The total items found.
  • Status
    The status of the search operation.
  • ErrorCode
    The error code of the search operation.

SEARCHLIST Object

The SEARCHLIST object is returned when a search is performed. SEARCHLIST is defined below:

                  
Version (int)
SearchId (int)
Returned (int)
LastId (int)
Total (int)
Status (int)
Results (dictionaryOf (int, listOf PACKET))
                  
                

  • Version
    Indicates structure version.
  • SearchId
    The search id that can be used to reference this search later.
  • Returned
    The number of PACKET objects returned.
  • LastId
    The id of the last item returned.
  • Status
    The status of the search operation.
  • Results
    A dictionary with the key as the capture id with a list of PACKET objects.

SEARCHSYNTAX Object

The SEARCHSYNTAX object is returned when a search filter validation check is performed. SEARCHSYNTAX is defined below:

                  
Version (int)
ErrorCode (int)
Filter (int)
                  
                

  • Version
    Indicates structure version.
  • ErrorCode
    Indicates if the supplied filter is syntaxfully correct.
  • Filter
    The processed filter output. Will be blank on error.

STATSCAPTUREQUERY Object

The STATSCAPTUREQUERY object is a ligher version of the CAPTUREMETA object. STATSCAPTUREQUERY provides packet counts of a specific capture session. STATSCAPTUREQUERY is defined below:

                  
Version (int)
TotalPackets (int)
TotalBytes (int)
TotalConnections (int)
TotalProcesses (int)
TotalIps (int)
Ip4 (int)
Ip6 (int)
TCP (int)
UDP (int)
ICMP (int)
                  
                

  • Version
    Indicates structure version.
  • TotalPackets
    Total number of packets captured during a specific capture session.
  • TotalBytes
    Total number of bytes captured during a specific capture session.
  • TotalConnections
    Total number of connections recorded during a specific capture session.
  • TotalProcesses
    Total number of processes captured during the session.
  • TotalIps
    Total number of unique IPs captured during the session.
  • Ip4
    Total number of IPv4 packets.
  • Ip6
    Total number of IPv6 packets.
  • TCP
    Total number of TCP packets.
  • UDP
    Total number of UDP packets.
  • ICMP
    Total number of ICMP packets.

STATSQUERY Object

The STATSQUERY object provides system wide values. STATSQUERY is defined below:

                  
Version (int)
Processes (int)
Captures (int)
LastCaptureId (int)
ActiveVersion (int)
Adapters (int)
TotalPackets (int)
TotalBytes (int)
TotalConnections (int)
                  
                

  • Version
    Indicates structure version.
  • Processes
    Total number of running processes.
  • Captures
    Total number of active captures.
  • LastCaptureId
    Last completed capture id.
  • ActiveVersion
    Value used to indicate when a capture session has changed. Gets incremented on each change.
  • Adapters
    Total number of network adapters.
  • TotalPackets
    Total number of packets captured or not.
  • TotalBytes
    Total number of bytes captured or not.
  • TotalConnections
    Total number of connections identified.

THREAD Object

The THREAD object provides the process thread information. THREAD is defined below:

                  
Version (int)
Id (int)
ProcessId (int)
TotalPackets (int)
TotalBytes (int)
TotalConnections (int)
DTGStart (int)
DTGEnd (int)
                  
                

  • Version
    Indicates structure version.
  • Id
    Id of the trigger object that can be used to reference it.
  • ProcessId
    Id of the process the thread is associated with.
  • TotalPackets
    Total number of packets.
  • TotalBytes
    Total number of bytes.
  • TotalConnections
    Total number of connections.
  • DTGStart
    Date in UTC filetime of when the thread started.
  • DTGEnd
    Date in UTC filetime of when the thread closed. 0 if it is still running.

TRIGGER Object

The TRIGGER object provides the user defined trigger data. TRIGGER is defined below:

                  
Version (int)
Id (int)
Name (string)
TriggerType (int)
Filter (string)
Flags (int)
IsDirectory (int)
ModuleName (string)
Path (string)
ImgSrc (string)
Actions (listOf int)
                  
                

  • Version
    Indicates structure version.
  • Id
    ID of the trigger object that can be used to reference it.
  • Name
    Trigger name useful for display purposes.
  • TriggerType
    Type of the trigger.
  • Filter
    Filter that will be applied for any capture session started by this trigger.
  • Flags
    Option flags for the trigger event.
  • IsDirectory
    Set to 1 if the path is a directory.
  • ModuleName
    Executable file name (without path) of the trigger process.
  • Path
    Full file path of trigger process.
  • ImgSrc
    Relative image source (i.e. /img/icons/...) to the trigger process icon.
  • Actions
    List of associated action ids.