Feature Request: Uploading PCAP to Timesketch

[JakePeralta7]

Plaso doesn't parse PCAP files, and I think it can be a very useful processor.

Parsing PCAP files can be easily accomplished using scapy or pyshark.

[ramo-j]

I like the idea, but this feature would probably be better living in timesketch (or indeed plaso.) Have you raised FR's there?

Reason being, there are multiple upload methods to Timesketch, DFTW being only one of them. It would make sense to me that TS does the parsing of the pcap, no matter the upload method.

[JakePeralta7]

Got it, will try raising the FR in Plaso