get_conversations
Extract network conversations from a pcap file to identify communicating hosts, protocols, and bandwidth usage by packet and byte counts.
Instructions
Extract network conversations/flows from a pcap file.
Use this tool to see which hosts are communicating and how much data they're exchanging. Useful for identifying top bandwidth consumers.
Args: file_path: Path to the pcap or pcapng file max_packets: Maximum packets to analyze (default: 100000) top_n: Return top N conversations by packet count (default: 20)
Returns: List of conversations with source/dest, protocol, packets, and bytes
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | ||
| max_packets | No | ||
| top_n | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |