PCAP Carving Issue

[denn1sthemenac3]

Version

2.4.111

Installation Method

Cloud image (Amazon, Azure, Google)

Description

other (please provide detail below)

Installation Type

Standalone

Location

cloud

Hardware Specs

Exceeds minimum requirements

CPU

4

RAM

64gb

Storage for /

512gb

Storage for /nsm

512gb

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

BLUF: pcap carving feature in SOC not working (attempts to carve, but ultimately ends up empty) .

• Running standalone SecOnion 2.4.111 on an AWS instance.
• Using suricata for pcap collection.
• Confirmed pcap is being captured and stored in /nsm/suripcap/1,2,3 (but interesting enough- under grid, my NSM partition usage is at 0% but pcap retention is showing at 43 days)
• max hard drive space is set to 132GB on standalone

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.