Network

{% set net = results.network %} {% if net.sources %}

Sources: {{ net.sources | join(', ') }}

{% endif %} {% if net.dns %}

DNS

{% for q in net.dns %} {% endfor %}

Request	Type	Answers
{{ q.request }}	{{ q.type }}	{{ q.answers \| map(attribute='data') \| join(', ') }}

{% endif %} {% if net.http %}

HTTP Requests

{% for r in net.http %} {% endfor %}

Method	Host	Port	URI
{{ r.method }}	{{ r.host }}	{{ r.port }}	{{ r.uri }}

{% endif %} {% if net.domains %}

Domains

{% for d in net.domains %} {% endfor %}

Domain	IP
{{ d.domain }}	{{ d.ip }}

{% endif %} {% if net.hosts %}

Hosts

{% for h in net.hosts %} {% endfor %}

IP
{{ h.ip }}

{% endif %} {% for proto in ['tcp', 'udp'] %} {% if net[proto] %}

{{ proto | upper }} Flows

{% for f in net[proto] %} {% endfor %}

Source	Destination	Port
{{ f.src }}{% if f.sport %}:{{ f.sport }}{% endif %}	{{ f.dst }}	{{ f.dport }}

{% endif %} {% endfor %} {% if net.decrypted or net.http_ex or net.https_ex or net.smtp_ex %}

Decrypted / Plaintext

{% set dec = net.decrypted %} {% if dec %} {% if dec.error %}

Decryption unavailable: {{ dec.error }}

{% else %}

{{ dec.counts.https_ex }} decrypted, {{ dec.counts.http_ex }} cleartext, {{ dec.counts.smtp_ex }} smtp stream(s) reassembled from {{ dec.secrets }} TLS secret(s). {% if not (dec.counts.https_ex or dec.counts.http_ex or dec.counts.smtp_ex) %} No streams could be reassembled - the capture may lack TLS secrets or be truncated to a fixed frame size. {% endif %}

{% endif %} {% endif %} {# Request/response below are headers only; bodies are stored on disk by sha256. #} {% set http_streams = (net.http_ex or []) + (net.https_ex or []) %} {% if http_streams %}

{% for s in http_streams %}

{{ s.src }}:{{ s.sport }} → {{ s.dst }}:{{ s.dport }}

{% if s.request %}

Request

{{ s.request | replace('\x00', '') | truncate(8000, True, '\n... [truncated, full body on disk] ...', 0) }}

{% endif %} {% if s.req %}

request body: {{ s.req.sha256 }} ({{ s.req.size }} bytes){% if s.req.path %} - {{ s.req.path }}{% endif %}

{% endif %} {% if s.response %}

Response

{{ s.response | replace('\x00', '') | truncate(8000, True, '\n... [truncated, full body on disk] ...', 0) }}

{% endif %} {% if s.resp %}

response body: {{ s.resp.sha256 }} ({{ s.resp.size }} bytes){% if s.resp.path %} - {{ s.resp.path }}{% endif %}

{% if s.resp.preview %}

{{ s.resp.preview | join('\n') }}

{% endif %} {% endif %}

{% endfor %}

{% endif %} {% if net.smtp_ex %}

{% for s in net.smtp_ex %} {% set r = s.req or {} %}