Squert: pivot to CapMe for pcap

[dougburks]

No description provided.

[dougburks]

https://groups.google.com/d/topic/security-onion/n80a6LK696Q/discussion

[dougburks]

The version of CapMe currently in testing handles large pcaps more gracefully and provides some additional features. Ultimately, Squert will no longer handle pcap transcripts itself and simply pivot to CapMe.

squert.css:

td.sub2_capme {
text-decoration:underline;
cursor:pointer;
color:#4D5580;
}

squertMain.js:

// Transcript link
          txdata = "s" + i + "-" + cid + "-" + s2h(sid + "|" + utctimestamp + "|" + src_ip + "|" + src_port + "|" + dst_ip + "|" + dst_port);

          txBit = "<td class=\"sub sub2_inactive\">" + sid + "." + cid + "</div>";
          if (src_port != "-" && dst_port != "-") {
            // txBit = "<td class=\"sub sub2_active\" data-tx=" + txdata + " title='Generate Transcript'>" + sid + "." + cid + "</td>";
                var startDate = new Date(utctimestamp);
                var start_tz_offset = (startDate.getTimezoneOffset());
                var stime = startDate.setTime( startDate.getTime()/1000-(start_tz_offset*60) ) - 3600;
                var endDate = new Date(utctimestamp);
                var end_tz_offset = (endDate.getTimezoneOffset());
                var etime = endDate.setTime( endDate.getTime()/1000-(end_tz_offset*60) ) + 3600;
                txBit = "<td class='sub sub2_capme' title='Pivot to CapMe for transcript'> <a href='/capme/?sip=" + src_ip + "&dip=" + dst_ip + "&spt=" + src_port + "&dpt=" + dst_port + "&stime=" + stime + "&etime=" + etime + "&filename=squert' target='_blank'>" + sid + "." + cid + "</a></td>";
          }

[dougburks]

submitted for testing:
https://groups.google.com/d/topic/security-onion-testing/ltCcCArPA2o/discussion

[dougburks]

published:
http://blog.securityonion.net/2016/06/new-capme-and-squert-packages-resolve.html