GreyNoise
API Reference
Start typing to search…

Export PCAP for Multiple Sessions

get
https://api.greynoise.io/v3/sessions/export

Returns a PCAP file containing packets from sessions matching the query criteria. The response is a binary PCAP file suitable for analysis with tools like Wireshark.

Not available when scope=demo (returns 403).

Query Params
string
enum
Defaults to workspace

Controls the data scope for the query.

  • workspace: Query data from the current workspace (default). Requires the Sensors entitlement.
  • demo: Query demo/sample data. Requires the Swarm entitlement. Not available on export endpoints.
Allowed:
date-time
required

Start time for the query range (ISO 8601 format).

date-time
required

End time for the query range (ISO 8601 format).

string

Lucene query string to filter sessions.

integer
Defaults to 100

Maximum number of sessions to include in the export.

string
Defaults to lastPacket

Field to sort results by.

string
enum
Defaults to true

Whether to sort in descending order.

Allowed:
Headers
string
enum
Defaults to application/json

Generated from available response content types

Allowed:
Responses

Updated 20 days ago

Language
Credentials
Header
URL
Response 
Click Try It! to start a request and see the response here! Or choose an example:
application/vnd.tcpdump.pcap
application/json
Updated 20 days ago