AnsweredAssumed Answered

Applying custom feeds to already parsed decoder data

Question asked by Ben May on Jun 4, 2013
Latest reply on Jun 10, 2013 by RSA Admin

I am wondering if anyone has any real world examples where they have the ability to be able to apply a single feed to already parsed data on a decoder.


The use case is that we have custom feeds that are produced and want to have them applied to all data on the decoder, not just data that has not been parsed. I understand that the only way this can be accomplished is to extract the already parsed data from the decoder to a pcap and then have it replayed back through a decoder.  The main issue with this approach is that all the data being replayed would be parsed as opposed to just the single feed.