question Re: metron pcap query in Archives of Support Questions (Read Only)

metron pcap query

nnat25191 — Thu, 01 Feb 2018 03:14:08 GMT

Hi,

I've noticed in the later releases of Metron, there's a new script pcap_zeppelin_run.sh. Does anyone know the use case of this script? I'm very curious in any pcap development within Metron. From reading the script, it looks like a it wraps around the pcap_query script and it's still in the testing phase? Will we be doing pcap query from zeppelin notebook?

thanks

Re: metron pcap query

sball — Sun, 18 Aug 2019 06:01:43 GMT

The intention behind this is very much to move towards PCAP query within zeppelin. This script is effectively a backend to provide access to pcap query via a zeppelin interpreter. If you install the sample zeppelin notebooks you will find one demonstrating the PCAP capabilities.

The notebook is used like this:

Re: metron pcap query

nnat25191 — Tue, 06 Feb 2018 23:28:14 GMT

@Simon Elliston Ball

Wonderful news! Thank you for the snapshot and the information, I was able to run the script, but I need to work on the query syntax. I assume the query syntax is in Stellar.