0

I have four export options: -Libcap -Html -Text -App Data

I can obviously read the Html and Text data, but they are formatted horribly for being able to slice and dice in Excel or, preferably, for importing into SQL Server where I could best analyze it.

I am not familiar with either the Libcap or App Data options as I am not a networking guy. Primarily I am just trying to get this data into a usable format where I can try to identify whether most the traffic we're having is legitimate or not and maybe block some IP's as necessary.

I'm a software developer but not really a networking guy so this may be out of my league, but I thought I'd at least ask and see if someone could point me in the right direction.

  • 2
    Not familiar with SonicWall, but Libcap sounds like it could be loaded into Wireshark, which is a pretty good option. – Zac67 Nov 15 '19 at 7:32
  • 1
    And I think it's libpcap actually. Yes, that can be parsed in a number of ways, either programatically or via Wireshark. – schaiba Nov 15 '19 at 8:55
1

I am certified SNSA (Sonicwall) and work with Sonicwall everyday for a MSP, we only use the libpcap w/wireshark as it is the most detailed and IMO easiest to work with. You can filter streams and the best tool used for sniffing network traffic, again IMO.

All of the data packets thats captured, gets stored in memory then presented on the screen, or in html format via browser, or text via notepad, or App Data which will only show you the application data and skip presenting packets that doesn't have any Layer 7 data such as a ping.

Export As : Display or save a snapshot of the current buffer in the file format that you select from the drop-down list. Saved files are placed on your local management system (where the management interface is running). Choose from the following formats:

• Libpcap - Select Libpcap format if you want to view the data with the Wireshark (formerly Ethereal) network protocol analyzer. This is also known as libcap or pcap format. A dialog box allows you to open the buffer file with Wireshark, or save it to your local hard drive with the extension .pcap .

• Html - Select Html to view the data with a browser. You can use File > Save As to save a copy of the buffer to your hard drive.

• Text - Select Text to view the data in a text editor. A dialog box allows you to open the buffer file with the registered text editor, or save it to your local hard drive with the extension .wri .

• App Data - Select App Data to view only application data contained in the packet. Packets containing no application data are skipped during the capture. Application data = captured packet minus L2, L3, and L4 headers.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.