AppPacCap

Application Packet Capture: A better way to PCAP.

Data Objects

AppPacCap provides a RESTful API that allows for control of the packet capture process as well as the visualization of the data. This powerful back-end functionailty can be used to create useful and functional front-ends that meet specific needs. Here you can explore the data objects returned by AppPacCap.

RESPONSE Object

All data is returned as a JSON object. Every request is wrapped in a RESPONSE object. RESPONSE is defined below:

                  
ErrorCode (int)
DataType (int)
ReturnValue (string)
                  
                

The ErrorCode field is used to indicate success or failure. ErrorCode of zero (0) indicates success while anything greater than zero is an error. Anything less than zero is invalid. Here are some common error code values:

                  
ERROR_SERVE_SUCCESS = 0
ERROR_SERVE_GENERIC_ERROR = 1
ERROR_SERVE_NO_TOKEN = 2
ERROR_SERVE_NO_PAGE = 3
ERROR_SERVE_MALFORMED_REQUEST = 4
ERROR_SERVE_SESSION_TIMEOUT = 5
ERROR_SERVE_INVALID_PERMISSIONS = 8
ERROR_SERVE_INVALID_CREDENTIALS = 9
ERROR_SERVE_INVALID_LICENSE = 12
                  
                

DataType indicates what the ReturnValue represents. Possible options are:

                  
DATA_TYPE_STRING = 1
DATA_TYPE_INT = 2
DATA_TYPE_JSON = 3
DATA_TYPE_HEX = 4
                  
                

All objects start with a Version field. This will be updated if the object structure changes. Please ensure you check this field when processing the object.

APPPACCAP Object

The APPPACCAP object povides information on the current AppPacCap installation. This information can be used to tailor the interface based on the returned values. APPPACCAP is defined below:

                  
Version (int)
AppPacCap (string)
Licensed (int)
LicenseType (string)
MachineName (string)
OS (string)
MapData (int)
Threat (int)
Updated (int)
                  
                

• Version
  Indicates structure version.
• AppPacCap
  Provides the current AppPacCap installation version.
• Licensed
  Indicates if AppPacCap is licensed. 1 if true, 0 if false.
• LicenseType
  A string representation of the current license.
• MachineName
  The computer name.
• OS
  The OS version.
• MapData
  Indicates if GeoLite2 map data is available. 1 if true, 0 if false.
• Threat
  Indicates if threat intel URLs have been provided. 1 if true, 0 if false.
• Updated
  Indicates if AppPacCap was updated the last time it ran. 1 if true, 0 if false.

ACTION Object

The ACTION object is used to represent user defined actions that can be triggered by certain events. ACTION is defined below:

                  
Version (int)
Id (int)
Name (string)
ActionType (int)
Triggers (listOf int)
ModuleName (string)
Path (string)
ImgSrc (string)
Parameters (string)
Flags (int)
                  
                

• Version
  Indicates structure version.
• Id
  Action id value used to reference this action where an id value is required.
• Name
  Action name useful for display purposes.
• ActionType
  Defines what action should occur.
• Triggers
  List of associated trigger ids. Count will be zero if is a system wide action.
• ModuleName
  Executable file name (without path) if defined by the action.
• Path
  Full file path if defined by the action.
• ImgSrc
  Relative image source (i.e. /img/icons/...) to executable icon.
• Parameters
  Parameters to be passed if defined by the action.
• Flags
  Additional action specific flags.

CAPTURE Object

The CAPTURE object is used to define active capture sessions. CAPTURE is defined below:

                  
Version (int)
CaptureId (int)
ProcessId (int)
Pid (int)
Tid (int)
Filter (string)
TotalPackets (int)
TotalBytes (int)
DTGStart (int)
DTGEnd (int)
IsSystem (int)
ModuleName (string)
Path (string)
ImgSrc (string)
Notes (string)
                  
                

• Version
  Indicates structure version.
• CaptureId
  Capture id value used to reference this capture where an id value is required.
• Pid
  System process id that is being captured. If system capture, this will be 4.
• Tid
  System thread id that is being captured. If all process threads are being captured, this will be 0.
• Filter
  The filter string used to filter captured packets. Blank if none provided.
• TotalPackets
  Total number of packets captured.
• TotalBytes
  Total bytes of all packets captured.
• DTGStart
  Start date in UTC filetime.
• DTGEnd
  End date in UTC filetime. If capture is still active, this will be 0.
• IsSystem
  1 if is a system wide capture, 0 otherwise.
• ModuleName
  Executable file name (without path) of the process being captured. If system capture, this will be 'System.'
• Path
  Full file path of process being captured. If system capture, this will be 'System.'
• ImgSrc
  Relative image source (i.e. /img/icons/...) to process icon.
• Notes
  User defined notes about the capture session.

CAPTUREMETA Object

CAPTUREMETA is used to define additional details about the active or closed capture sessions. CAPTUREMETA is defined below:

                  
Version (int)
CaptureId (int)
ProcessId (int)
Pid (int)
Tid (int)
ModuleName (string)
Path (string)
ImgSrc (string)
ParentPid (int)
ParentModuleName (string)
ParentPath (string)
ParentImgSrc (string)
DTGFirst (int)
DTGLast (int)
LastConnectionId (int)
LastIpId (int)
LastPacketId (int)
LastProcessId (int)
TotalPackets (int)
TotalBytes (int)
TotalConnections (int)
                  
                

• Version
  Indicates structure version.
• CaptureId
  Capture id value used to reference this capture where an id value is required.
• ProcessId
  Process id value used to reference this process where an id value is required.
• Pid
  System process id that is being captured. If system capture, this will be 4.
• Tid
  System thread id that is being captured. If all threads in a process or is system capture, this will be 0.
• ModuleName
  Executable file name (without path) of the process being captured. If system capture, this will be 'System.'
• Path
  Full file path of process being captured. If system capture, this will be 'System.'
• ImgSrc
  Relative image source (i.e. /img/icons/...) to process icon.
• ParentPid
  System process id of the parent process. Only valid if capture was triggered by parent.
• ParentModuleName
  Executable file name (without path) of the parent process. Only valid if capture was triggered by parent.
• ParentPath
  Full file path of parent process. Only valid if capture was triggered by parent.
• ParentImgSrc
  Relative image source (i.e. /img/icons/...) to the parent process icon. Only valid if capture was triggered by parent.
• DTGFirst
  Date in UTC filetime of the first packet captured.
• DTGLast
  Date in UTC filetime of the last packet captured.
• LastConnectionId
  ID of the most recent connection. Can be used to query for latest updates.
• LastIpId
  ID of the most recent IP. Can be used to query for latest updates.
• LastPacketId
  ID of the most recent packet. Can be used to query for latest updates.
• LastProcessId
  ID of the most recent process. Can be used to query for latest updates.
• TotalPackets
  Total number of packets captured.
• TotalBytes
  Total bytes of all packets captured.
• TotalConnections
  Total number of connections recorded.

COMMAND Object

The COMMAND object is used to relay status information about pending commands. COMMAND is defined below:

                  
Version (int)
Uid (string)
Command (string)
Status (int)
ErrorCode (int)
Output (string)
DtgAdd (int)
DtgUpdate (int)
                  
                

• Version
  Indicates structure version.
• Uid
  Command id string used for reference purposes.
• Command
  String based value of the requested command.
• Status
  Commands are not executed right away and are queued up. Status indicates where in the process the command is.
• ErrorCode
  Provides additional information on success or failure of command.
• Output
  Command specific output data. For example, could be a filename or process output.
• DTGAdd
  Date in UTC filetime of when the command was created.
• DTGUpdate
  Date in UTC filetime of when the command was last updated.

CONNECTION Object

The CONNECTION object provides details about the process that initiated a network connection. CONNECTION is defined below:

                  
Version (int)
Id (int)
Pid (int)
Tid (int)
DTG (int)
SrcIp (string)
SrcPort (int)
DstIp (string)
DstPort (int)
                  
                

• Version
  Indicates structure version.
• Pid
  System process id.
• Tid
  System thread id.
• DTG
  Date in UTC filetime of when the connection was created.
• SrcIp
  The source IP.
• SrcPort
  The source port.
• DstIp
  The destination IP.
• DstPort
  The destination port.

EXPORTFILE Object

The EXPORTFILE object defines exported PCAP file metadata. EXPORTFILE is defined below:

                  
Version (int)
FileName (string)
RelativePath (string)
                  
                

• Version
  Indicates structure version.
• FileName
  The full file path where the pcap is located on disk.
• RelativePath
  The relative path of the pcap file.

EXTRACTFILE Object

The EXTRACTFILE object defines extracted file metadata on disk. EXTRACTFILE is defined below:

                  
Version (int)
FileId (int)
FileName (string)
RelativePath (string)
FileType (string)
Size (int)
                  
                

• Version
  Indicates structure version.
• FileId
  The file id of the file.
• FileName
  The full path where the file is located on disk.
• RelativePath
  The relative path of the file.
• FileType
  The extension of the file without the period (.).
• Size
  The size of the file on disk.

EXTRACTSTREAM Object

The EXTRACTSTREAM object defines extracted file stream metadata. EXTRACTSTREAM is defined below:

                  
Version (int)
StreamId (int)
Protocol (int)
FileName (string)
                  
                

• Version
  Indicates structure version.
• StreamId
  The stream id of the capture session.
• Protocol
  Numerical value of the protocol.
• FileName
  The name of the file pulled from the packet.

IP Object

The IP object defines IP metadata. IP is defined below:

                  
Version (int)
Id (int)
Ip (string)
Country (string)
City (string)
HostName (string)
Lat (decimal)
Lng (decimal)
Data (string)
DTG (int)
                  
                

• Version
  Indicates structure version.
• Id
  The id of the IP address.
• Ip
  The IP address.
• Country
  Geolocated country.
• City
  Geolocated city.
• HostName
  Resolved host name.
• Lat
  Geolocated latitude.
• Lng
  Geolocated longitude.
• Data
  Associated user-defined data.
• DTG
  Date in UTC filetime of when the IP was first captured.

NETADAPTER Object

NETADAPTER defines network adapters on the system. NETADAPTER is defined below:

                  
Version (int)
Name (string)
Up (int)
MAC (string)
Ip4 (string)
Ip6 (string)
TapId (int)
                  
                

• Version
  Indicates structure version.
• Name
  Name of the network adapter.
• Up
  1 indicates the adapter is connected, 0 otherwise.
• MAC
  MAC address of the adapter.
• Ip4
  IPv4 address of the adapter.
• Ip6
  IPv6 address of the adapter.
• TapId
  The adapter id. 0 if not being captured. (Version 2)

PACKET Object

The PACKET object provides both metadata about the packet and the actual raw packet bytes. PACKET is defined below:

                  
Version (int)
ConnectionId (int)
Id (int)
DTG (int)
Size (int)
SrcIp (string)
SrcPort (int)
DstIp (string)
DstPort (int)
L2t (int)
L2l (int)
L3t (int)
L3o (int)
L3l (int)
L4t (int)
L4o (int)
L4l (int)
L5o (int)
L5l (int)
HexBytes (string)
Notes (string)
                  
                

• Version
  Indicates structure version.
• ConnectionId
  Connection id this packet is associated with.
• Id
  Packet id that can be used to reference this packet.
• DTG
  Date in UTC filetime of when the packet was captured.
• Size
  The number of bytes of the captured packet.
• SrcIp
  The source IP.
• SrcPort
  The source port.
• DstIp
  The destination IP.
• DstPort
  The destination port.
• L2t
  Layer 2 header type.
• L2l
  Layer 2 header length.
• L3t
  Layer 3 header type.
• L3o
  Layer 3 header offset.
• L3l
  Layer 3 header length.
• L4t
  Layer 4 header type.
• L4o
  Layer 4 header offset.
• L4l
  Layer 4 header length.
• L5o
  Layer 5 header offset.
• L5l
  Layer 5 header length.
• HexBytes
  The captured packet in hex format.
• Notes
  User defined notes about the packet.

PACKETSTREAM Object

The PACKETSTREAM object is used to return a large number of PACKET and PROCCON objects during a query. PACKETSTREAM is defined below:

                  
Version (int)
CaptureId (int)
LastConnectionId (int)
LastIpId (int)
LastPacketId (int)
LastProcessId (int)
Count (int)
Returned (int)
Total (int)
Packets (listOf PACKET)
ProcessConnections (dictionaryOf (int, PROCCON))
                  
                

• Version
  Indicates structure version.
• CaptureId
  Capture id these packets are associated with.
• LastConnectionId
  ID of the most recent connection. Can be used to query for latest updates.
• LastIpId
  ID of the most recent IP. Can be used to query for latest updates.
• LastPacketId
  ID of the most recent packet. Can be used to query for latest updates.
• LastProcessId
  ID of the most recent process. Can be used to query for latest updates.
• Count
  The number of packets in the list.
• Returned
  The number of packets before the first one in the list.
• Total
  The total number of captured packets.
• Packets
  A list of individual PACKET objects.
• ProcessConnections
  A dictionary with a key/value pair of {ConnectionId/PROCCON}.

PROCCONN Object

The PROCCONN object provides details about a specific connection. PROCCONN is defined below:

                  
Version (int)
Pid (int)
Tid (int)
Path (string)
ModuleName (string)
ImgSrc (string)
                  
                

• Version
  Indicates structure version.
• Pid
  System process id.
• Tid
  System thread id.
• ModuleName
  Executable file name (without path) of the process.
• Path
  Full file path of process.
• ImgSrc
  Relative image source (i.e. /img/icons/...) to process icon.

PROCESS Object

The PROCESS object provides details about a running or closed process. PROCESS is defined below:

                  
Version (int)
Id (int)
Pid (int)
Threads (listOf int)
ModuleName (string)
Path (string)
ImgSrc (string)
DTGStart (int)
DTGEnd (int)
Captures (int)
                  
                

• Version
  Indicates structure version.
• Pid
  System process id.
• Threads
  A list of all process threads that have associated network activity.
• ModuleName
  Executable file name (without path) of the process.
• Path
  Full file path of process.
• ImgSrc
  Relative image source (i.e. /img/icons/...) to process icon.
• DTGStart
  Date in UTC filetime of when the process was created.
• DTGEnd
  Date in UTC filetime of when the process closed. This will be 0 if the process is still running.
• Captures
  The number of completed captures asosciated with this process.

SEARCHMETA Object

The SEARCHMETA object describes a search query and status. SEARCHMETA is defined below:

                  
Version (int)
Id (int)
Query (string)
FoundCount (int)
Status (int)
ErrorCode (int)
                  
                

• Version
  Indicates structure version.
• Id
  The search id.
• Query
  The submitted query.
• FoundCount
  The total items found.
• Status
  The status of the search operation.
• ErrorCode
  The error code of the search operation.

SEARCHLIST Object

The SEARCHLIST object is returned when a search is performed. SEARCHLIST is defined below:

                  
Version (int)
SearchId (int)
Returned (int)
LastId (int)
Total (int)
Status (int)
Results (dictionaryOf (int, listOf PACKET))
                  
                

• Version
  Indicates structure version.
• SearchId
  The search id that can be used to reference this search later.
• Returned
  The number of PACKET objects returned.
• LastId
  The id of the last item returned.
• Status
  The status of the search operation.
• Results
  A dictionary with the key as the capture id with a list of PACKET objects.

SEARCHSYNTAX Object

The SEARCHSYNTAX object is returned when a search filter validation check is performed. SEARCHSYNTAX is defined below:

                  
Version (int)
ErrorCode (int)
Filter (int)
                  
                

• Version
  Indicates structure version.
• ErrorCode
  Indicates if the supplied filter is syntaxfully correct.
• Filter
  The processed filter output. Will be blank on error.

STATSCAPTUREQUERY Object

The STATSCAPTUREQUERY object is a ligher version of the CAPTUREMETA object. STATSCAPTUREQUERY provides packet counts of a specific capture session. STATSCAPTUREQUERY is defined below:

                  
Version (int)
TotalPackets (int)
TotalBytes (int)
TotalConnections (int)
TotalProcesses (int)
TotalIps (int)
Ip4 (int)
Ip6 (int)
TCP (int)
UDP (int)
ICMP (int)
                  
                

• Version
  Indicates structure version.
• TotalPackets
  Total number of packets captured during a specific capture session.
• TotalBytes
  Total number of bytes captured during a specific capture session.
• TotalConnections
  Total number of connections recorded during a specific capture session.
• TotalProcesses
  Total number of processes captured during the session.
• TotalIps
  Total number of unique IPs captured during the session.
• Ip4
  Total number of IPv4 packets.
• Ip6
  Total number of IPv6 packets.
• TCP
  Total number of TCP packets.
• UDP
  Total number of UDP packets.
• ICMP
  Total number of ICMP packets.

STATSQUERY Object

The STATSQUERY object provides system wide values. STATSQUERY is defined below:

                  
Version (int)
Processes (int)
Captures (int)
LastCaptureId (int)
ActiveVersion (int)
Adapters (int)
TotalPackets (int)
TotalBytes (int)
TotalConnections (int)
                  
                

• Version
  Indicates structure version.
• Processes
  Total number of running processes.
• Captures
  Total number of active captures.
• LastCaptureId
  Last completed capture id.
• ActiveVersion
  Value used to indicate when a capture session has changed. Gets incremented on each change.
• Adapters
  Total number of network adapters.
• TotalPackets
  Total number of packets captured or not.
• TotalBytes
  Total number of bytes captured or not.
• TotalConnections
  Total number of connections identified.

THREAD Object

The THREAD object provides the process thread information. THREAD is defined below:

                  
Version (int)
Id (int)
ProcessId (int)
TotalPackets (int)
TotalBytes (int)
TotalConnections (int)
DTGStart (int)
DTGEnd (int)
                  
                

• Version
  Indicates structure version.
• Id
  Id of the trigger object that can be used to reference it.
• ProcessId
  Id of the process the thread is associated with.
• TotalPackets
  Total number of packets.
• TotalBytes
  Total number of bytes.
• TotalConnections
  Total number of connections.
• DTGStart
  Date in UTC filetime of when the thread started.
• DTGEnd
  Date in UTC filetime of when the thread closed. 0 if it is still running.

TRIGGER Object

The TRIGGER object provides the user defined trigger data. TRIGGER is defined below:

                  
Version (int)
Id (int)
Name (string)
TriggerType (int)
Filter (string)
Flags (int)
IsDirectory (int)
ModuleName (string)
Path (string)
ImgSrc (string)
Actions (listOf int)
                  
                

• Version
  Indicates structure version.
• Id
  ID of the trigger object that can be used to reference it.
• Name
  Trigger name useful for display purposes.
• TriggerType
  Type of the trigger.
• Filter
  Filter that will be applied for any capture session started by this trigger.
• Flags
  Option flags for the trigger event.
• IsDirectory
  Set to 1 if the path is a directory.
• ModuleName
  Executable file name (without path) of the trigger process.
• Path
  Full file path of trigger process.
• ImgSrc
  Relative image source (i.e. /img/icons/...) to the trigger process icon.
• Actions
  List of associated action ids.