How to navigate disk inside Netgate appliance from GUI?

[SteveITS]

@rloeb said in How to navigate disk inside Netgate appliance from GUI?:

download a file if your know it's full path

I stand corrected, guess I never used that page for that. :)

Try 'find / -name "*.pcap"' if you know the extension, perhaps limited to /var instead of /. Or "find / -type f -mtime -1" for files in the last day.

[rloeb]

@teamits Thank you.

[rloeb]

@rloeb Note: If you use WinSCP to navigate the disk in a Netgate pfsense appliance, you cannot download the files that are captured by the process I was using. Access is denied when you attempt to download. I don't understand why access is denied, although I can appreciate why "write" or "modify" access would be denied.

[Gertjan]

Strange.

Just tested WinSCP myself.
When packet capturing from this web page https://pfsense.local.net/diag_packet_capture.php ( it tells me where the captured file is kept ) :

$fp = "/root/";
$fn = "packetcapture.cap";

I could load the /root/packetcapture.cap file with a click :

[rloeb]

@gertjan .../diag_packet_capture.php is the page displayed from the pfsense menu: Diagnostics|Packet Capture. I do not find any information there about where the captured packet is stored. (However, there may be such information if packets are captured using the packet capture capabilities on that page, which I didn't attempt.)

The packets captured from Services|Snort|Edit Interface|LAN|Alert Settings|Enable Packet Captures are stored in a directory: /var/log/snort/snort_igbnnnnnn (nnnnnn = 6 digits; new directory created each time instantiated) as a .log file. If "Enable Unified2 Logging" is also checked, then a .U2 file is also created in the same directory.

That directory cannot be opened by WinSCP (permission denied). The only way I have found to display or download either file is by using Diagnostics|Command Prompt within Snort.

[Gertjan]

@rloeb

Didn't know you were using snort.

Thought it was :

[rloeb]

@gertjan Regardless, your help has been invaluable. I learned a bunch!

[stephenw10]

You can just browse (and open) files in Diag > Edit File. Often easiest.

Steve

[rloeb]

@stephenw10 My issue was finding the file to view/edit :-)

[stephenw10]

Right but you can click browse there and look for it if you have some vague idea.