net.export.conf

# NETCAP config for export tool
# Generated by NETCAP v0.5.2
# You can regenerate an up to date default configuration with:
# 	$ net <tool> -gen-config > net.<tool>.conf

# set address for exposing metrics
address 127.0.0.1:7777

# support streams without SYN/SYN+ACK/ACK sequence
allowmissinginit true

# select base layer
base ethernet

# supply a BPF filter to use prior to processing packets with netcap
bpf 

# buffer data in memory before writing to disk
buf true

# check TCP checksum
checksum false

# reassembly: close connections that are inactive after X
close-inactive-timeout 1h0m0s

# reassembly: close connections that have pending bytes after X
close-pending-timeout 1h0m0s

# compress output with gzip
comp true

# read configuration from file at path
config 

# flush connections every X flows
conn-flush-interval 0

# close connections older than X seconds
conn-timeout 0s

# add packet flow context to selected audit records
context true

# print output data as csv with header line
csv false

# display debug information
debug false

# path to directory with netcap audit records
dir 

# use DPI for device profiling
dpi false

# dump as JSON
dumpJson false

# enable entropy calculation for Eth,IP,TCP and UDP payloads
entropy false

# exclude specific decoders
exclude 

# path to created extracted files (currently only for HTTP)
fileStorage 

# flushes flows every X flows
flow-flush-interval 0

# closes flows older than flowTimeout
flow-timeout 0s

# flush assembler every N packets
flushevery 100

# use geolocation for device profiling
geoDB false

# dump packets used in stream reassembly as hex to the reassembly.log file
hexdump false

# attach to network interface and capture in live mode
iface 

# disable writing unknown packets into a pcap file
ignore-unknown false

# ignore TCP FSM errors
ignorefsmerr true

# include specific decoders
include 

# list all visible network interfaces
interfaces false

# Defragment IPv4 packets
ip4defrag true

# use ja3 database for device profiling
ja3DB false

# resolve DNS locally via hosts file in the database dir
local-dns false

# enable verbose packet decoding error logging
log-errors false

# use mac to vendor database for device profiling
macDB false

# set size for membuf
membuf-size 12582912

# create memory profile
memprof false

# write memory profile
memprofile 

# do not check TCP options (useful to ignore MSS on captures with TSO)
nooptcheck true

# select decoding options
opts lazy

# specify output directory, will be created if it does not exist
out 

# capture payload for supported layers
payload false

# set packet buffer size, for channels that feed data to workers
pbuf 100

# toggle promiscuous mode for live capture
promisc true

# read specified file, can either be a pcap or netcap audit record file
read 

# replay traffic (only works when exporting audit records directly!)
replay false

# resolve ips to domains via the operating systems default dns resolver
reverse-dns false

# use serviceDB for device profiling
serviceDB false

# configure snaplen for live capture from interface
snaplen 1514

# print netcap package version and exit
version false

# wait for all connections to finish processing before cleanup
wait-conns true

# number of workers
workers 12

# write incomplete response
writeincomplete false