Full Packet Capture Without an Agent

The full packet capture quick start covered the typical agent/server deployment, with an EveBox Agent on each sensor. But if everything runs on one host, you don't need an agent at all. When the EveBox Server is already consuming Suricata's EVE log and the capture spool sits on the same host, full packet capture is one setting away: no agent, no keys.

The Setup

This post assumes a single host where:

• Suricata is writing eve.json and a pcap-log capture spool.
• The EveBox Server is reading the EVE log directly.

If you don't have a capture spool going yet, see the spool section of the quick start. And as with any full packet capture setup, EveBox 0.27.0 or newer is required. See the installation documentation for installing or upgrading.

Point the Server at the Spool

Add a pcap section to evebox.yaml:

input:
  enabled: true
  paths:
    - "/var/log/suricata/eve.json"

pcap:
  directory: /var/log/suricata/pcap

Or do it all on the command line:

evebox server --input /var/log/suricata/eve.json \
    --pcap-directory /var/log/suricata/pcap

Restart the server, and that's it. Once a spool directory is configured, the download controls appear in the web interface automatically.

Notes:

• Make sure the spool directory is readable by the EveBox Server process.
• If the directory does not exist yet, EveBox logs a warning and carries on. It is re-checked as requests come in, so it does not need to exist at startup.
• If multiple capture sets share one directory, add a prefix setting (or --pcap-prefix) so only matching files are considered.

Download Some Packets

Open an alert or event and select the PCAP button to download the packets around it. With only the server-local spool configured there is nothing to route or select; the download just works.

Per-event downloads are capped at 8 MB to keep them fast.

Notes and Limitations

• This does not work on Windows, where EveBox cannot extract packets itself. A Windows server can still offer capture downloads, but only through remote Linux agents.
• Retention stays where it was: Suricata's max-files setting bounds the spool, or use evebox pcap purge for spools written by other tools.

Where to Go Next

The packet capture documentation covers serving limits, routing, and the evebox pcap extract command for pulling packets from a spool without going through the server at all. And when a sensor moves to its own hardware, the quick start shows how to serve its spool with an agent.