I’ve made some changes to my simple to install and use PCAP spool web frontend Dumpy including:
- A rewrite in Go, mostly for entertainment purposes, but the really easy to use concurrency, and single binary installation make Go a good choice for small applications like this.
- Multiple spool directory support.
- A decoder for translating a Suricata JSON style event to a pcap filter (in additions to the existing “fast” style event decoding).
Check it out over here https://github.com/jasonish/dumpy.