Skip to content

pcap-metadata: add capture/file attributes, hashes, metrics, and bump version#514

Merged
adulau merged 1 commit intomainfrom
codex/improve-pcap-metadata-object
Apr 11, 2026
Merged

pcap-metadata: add capture/file attributes, hashes, metrics, and bump version#514
adulau merged 1 commit intomainfrom
codex/improve-pcap-metadata-object

Conversation

@adulau
Copy link
Copy Markdown
Member

@adulau adulau commented Apr 11, 2026

Motivation

  • Enrich pcap-metadata to capture more detailed information about packet captures for improved analysis and triage.
  • Provide common file-level metadata and checksum attributes to support integrity checks and tooling integrations.
  • Expose capture metrics and environment details to aid filtering, reporting, and automated processing.

Description

  • Added multiple new attributes to pcap-metadata including capture-application, capture-filter, capture-hardware, capture-operating-system, captured-packets, displayed-packets, dropped-packets, elapsed-time, encapsulation, file-format, file-hash-md5, file-hash-ripemd160, file-hash-sha1, file-hash-sha256, file-name, file-size-in-bytes, marked-packets, packet-size-limit, and time-span-seconds with appropriate misp-attribute types and ui-priority settings.
  • Added sane defaults for capture-application and kept/extended existing protocol sane list, and ensured capture-interface, first-packet-seen, last-packet-seen, and text remain available as required alternatives.
  • Bumped the schema version from 2 to 3 to reflect the compatibility-changing additions.

Testing

  • Ran the project schema validation against the updated objects/pcap-metadata/definition.json and it succeeded.
  • Executed the repository's automated unit test suite in CI and all tests passed.

Codex Task

@adulau adulau merged commit 2d2dab3 into main Apr 11, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant