You can specify -r multiple times. Something like import subprocess import glob cmd = ["bro"] for f in glob.glob("*.pcap"): cmd.extend(["-r", f]) subprocess.call(cmd) will work to a point. Eventually you will hit ARG_MAX with enough files. but for a few dozen this works fine. For more, something like https://github.com/assafmo/joincap could be better. I outlined a good way to do this as an input plugin a while back as well: http://mailman.icsi.berkeley.edu/pipermail/zeek/2017-July/012355.html On Mon, Apr 29, 2019 at 5:06 PM David Decker <x.faith(a)gmail.com> wrote: to process multiple PCAPS using the bro -r argument. to normal date/time output, but that is one at a time, and will have multiple. anyone has done this bfore. -- Justin _______________________________________________ Zeek mailing list zeek(a)zeek.org http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek

Looking to see if anyone has created a script, or if this is an argument to process multiple PCAPS using the bro -r argument. I have it setup to output to JSON currently and change from EPOCH time to normal date/time output, but that is one at a time, and will have multiple. Looking at either a batch script of maybe python but wanted to see if anyone has done this bfore. (Reingest multiple old PCAP files) to get re-ingested. Dave