nbb-sessions
Search sessions from Quad Miners Network Blackbox.
nbb-sessions [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss]
- profile=PROFILE
- The identifier of Network Blackbox connect profile
- duration=NUM{mon|w|d|h|m|s}
- Scan only recent sessions. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10smeans data from 10 seconds earlier. - from=yyyyMMddHHmmss
- Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=yyyyMMddHHmmss
- End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | String | Connect profile | The identifier of Network Blackbox connect profile |
| device_id | Integer | Device ID | |
| start_time | Date | Start time | Session start time |
| end_time | Date | End time | Session end time |
| hash | Long | Hash | Session identifier |
| src_ip | IP address | Source IP | |
| src_port | Integer | Source port | |
| dst_ip | IP address | Destination IP | |
| dst_port | Integer | Destination port | |
| protocol | String | Protocol | |
| src_country | String | Source country | |
| dst_country | String | Destination country | |
| http_method | String | HTTP method | |
| url | String | URL | |
| stream | Integer | Stream count | |
| sent_bytes | Long | Sent bytes | |
| rcvd_bytes | Long | Received bytes | |
| sent_pkts | Long | Sent packets | |
| rcvd_pkts | Long | Received packets | |
| app_category | String | App category | |
| app1 | String | App1 | |
| app2 | String | App2 | |
| is_session | Bool | Is session |