Query pcap Data Using the REST API
The REST API is an alternative to using the CLI and Stellar to query the pcap data.
The purpose of this service is to provide a middle tier to negotiate retrieving packet capture
data that flows into HCP. This packet data is in a form that libpcap
-based
tools can read. The REST API exposes the query functionality via http.
- srcIp
- srcPort
- dstIp
- dstPort
- startTime
- endTime
The fixed filter filters on explicit matches only so you cannot use any specialized functions or comparison operators. The query filter is far more expressive because it exposes Stellar, which enables the user to invoke specialized functions, use comparison operators, and perform boolean logic on the parameters.
You can start the fixed
filter service either via the init.d
script
installed, /etc/init.d/pcapservice
or directly via the yarn jar
command:
yarn jar $METRON_HOME/lib/metron-api-$METRON_VERSION.jar org.apache.metron.pcapservice.rest.PcapService -port $SERVICE_PORT -query_hdfs_path $QUERY_PATH -pcap_hdfs_path $PCAP_PATH
where
- METRON_HOME is the location of the metron installation
- METRON_VERSION is the version of the metron installation
- SERVICE_PORT is the port to bind the REST service to
- QUERY_PATH is the temporary location to store query results. They are deleted after the service reads them.
- PCAP_PATH is the path to the packet data on HDFS