Download session PCAP
arkime_session_pcapRead-only
Fetch and validate PCAP metadata for Arkime sessions, returning format and size without raw bytes. For large downloads, get a URL instead.
Instructions
Fetch and validate the PCAP for one or more Arkime sessions; returns METADATA ONLY.
Downloads the raw PCAP bytes, checks the file-magic (pcap/pcapng), and
returns metadata (magic, format, size) only — never the raw bytes, and
nothing is persisted to disk. A download over 500 MB is refused before
a byte is read; url_only=True is the way through, and the way to hand
the URL to something outside this agent. Needs a session id, which only
arkime_sessions produces.
For a session's parsed fields rather than its packets use
arkime_session_detail; for the bytes that crossed the wire rather than
the capture container that holds them use arkime_session_payload; and
for a file this specific session carried use
arkime_session_file_by_hash, which is more reliable than
arkime_file_by_hash whenever you already hold a session id.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url_only | No | If true, return only the download URL and skip the download (use for very large sessions). | |
| session_id | Yes | One Arkime session id, or several comma-separated, each taken from arkime_sessions results (arkime_sessions is the only source of these ids). Several ids are merged into one combined PCAP, and the size ceiling applies to that merged total rather than to each session. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |