Data no found when i open a pcap or pcapng file

[Zobber]

Hi,
I like brim so I download it and I install on Windows, I have some pcap and pcapng files, when i open these files in brim after a time dont show me nothing
Sorry for my english, i hope any comment or help for this :(

[philrz]

@Zobber: Thanks for your interest in Brim. I've spent some time studying some workflows that might produce the condition you've seen. It does seem like we need to improve the user interface to avoid these problems, and there's at least one specific Brim bug I need to open up that may describe precisely what went wrong for you. I need a little time to write that up, but after that I'll come back to this issue with some ideas on how to repair your experience in the Brim app. Please stay tuned. 😄

[philrz]

@Zobber: I've opened the bug I mentioned for the problem that I think may be similar to what you experienced. You can read it at #644. What seems similar is that in your screenshot you have the same filename analisis10 appearing twice, and that issue I filed is related to loading the same file multiple times in Brim. What's different, though, is that I can see in your screenshot that there's different file sizes for each analisis10, so it doesn't seem like they're exactly the same file. Do they have different filename extensions?

In any case, the fact that your screenshot shows you accessing a space analisis10_01.pcap.brim indicates that at some time you probably loaded the same analisis10.pcap twice into Brim, so there may have been a problem with its corresponding .brim directory having been deleted via Space deletion in the Brim app, or maybe it was deleted accidentally at the OS level. That would trigger the symptom you showed of a Space with no events, which is what's captured in #644.

In any case, hopefully the info at #644 clarifies the relationship between the Space and its corresponding pcap file, and may help explain what's wrong for you. To get you out of the current situation, for any Space for which you're seeing no data, click to a new tab in Brim and use the Trash icon to delete the Space.

Before reloading any pcaps again, make sure they have filenames that are unique from any you've already loaded into Brim. That will remove any confusion about duplicate Space names like the analisis_01.pcap.brim you saw here.

A couple more tips:

1. I observed from your screenshots that you seem to be running an older version of the Brim app. You should reinstall with the latest version at https://github.com/brimsec/brim/releases to have the benefit of other enhancements and bug fixes.

2. I understand that you may struggle with English. If you are a Slack user, you could join our public Slack to interact with us if you need more help. Your GitHub profile mentioned you're in Columbia, so I don't know if that means you might speak Spanish, but my colleague @siskojr (who is @Javier Rodriguez on our Slack) is from Spain if that helps.

Please do let us know if this helps fix your problem. Thanks for trying Brim!

[Zobber]

Hi @philrz Thanks you so much for reply and support me

You mean that I have a same name file , I realized it later hahaha, so i realized i wasn't doing it right

After this, I try download the lastest version of Brim and Install it as well as delete the generated files analisis10_01.pcap.brim and analisis10.pcap.brim.

All my files that I renamed them and check there was no folder like this:

So I Install the last version of Brim, open the file and the magic !!

Now all data from the pcap file are showing in brim. So Thanks you so much for the support

[siskojr]

Great news. Thanks @Zobber for testing and confirming.
Cheers
J