extends layout

block content
  - var operator = {ip: "==, !=", integer: "<, <=, ==, >=, >, !=", lotextfield: "==, !=", textfield: "==, !=", lotermfield: "==, !=", termfield: "==, !=", uptermfield: "==, !=", seconds: "<, <=, ==, >=, >, !="};
  - var datatype = {ip: "ip", integer: "integer", lotextfield: "lower cased tokenized string", textfield: "tokenized string", lotermfield: "lower case non tokenized string", termfield: "non tokenized string", uptermfield: "upper case non tokenized string", seconds: "Date/Time"};
  div(style="margin:10px")
    p Moloch is a open source large scale IPv4 PCAP capturing, indexing and database system.  A simple web interface is provided for PCAP browsing, searching, and exporting.  APIs are exposed that allow PCAP data and JSON formatted session data to be downloaded directly. Simple security is implemented by using https and HTTP digest password support.  Moloch is not meant to replace IDS engines but instead work along side them to store and index all the network traffic in standard PCAP format, providing fast access.  Moloch is built to be deployed across many machines and can scale to handle multiple megabits/sec of traffic.
    p Moloch uses a very simple query language for building expresions.  It supports grouping using parenthesis and logical AND and OR using && and || respectively.  Fields can be accessed directly using the field names and operators described in the table below. Most fields also support a shorthand OR query using square brackets using CSV rules to list possible values.
    
    h3 String Searches    
    p String fields are special since they can be search several different ways.  Before fields are indexed their case may or may not be normalized, which is documented in the table below.  The types of string searches are:
      ul
        dt Token
        dd Some string fields are tokenized for faster searching.  The query engine will automatically turn the search string(s) into tokens using the same algorithms as the indexing system.
        dt Lists
        dd This is a short hand method for doing multiple OR queries.  For example http.uri == [www, moloch].  Currently a list containing wildcard or regex strings will be processed as normal tokens instead of wildcards and regexs.
        dt Wildcard
        dd If a * appears in a expression, it is assumed a wildcard match is being used.  Supported wildcards are *, which matches any character sequence (including the empty one), and ?, which matches any single character.  The wildcard query is run against the full text strings, after case normalization if enabled for the field. For example 'http.uri == "www.f*k.com"'
        dt Regex
        dd A regex query needs to be surrounded by forward slashes, and is always anchored.  This means you will almost always want to include a leading and trailing ".*".  The regex query is run against the full text strings, after case normalization if enabled for the field.  For example 'http.uri == /.*www\.f.*k\.com.*/'.  It uses the Lucene regex implementation which doesn't support most PCRE features.

    h3 IP Searches    
    p IP searching is very flexible and can be performed using the full ip address, a partial ip address, or using CIDR representation.  For fields that include a port number, it is possible to follow any of the ip representations with a colon and then the port number.  Ports are also first class searchable and may be searched for directly.  For example ip == 1.2.3/24:80.  IP search can also be done with list of IPs.  ip == [1.2.3.4, 1.3/16]

    h3 Numeric Searches
    p Numeric fields support simple range operators besides the default equals and not equals.  For example port == 80.  They also support lists for a simple OR query. For example port==[80,443,23]

    h3 Date Searches
    p Date fields support simple range operators besides the default equals and not equals.  For example starttime == "2004/07/31 05:33:41".  They also support lists for a simple OR query. For example stoptime==["2004/07/31 05:33:41", "2004/07/31 06:33:41"].  Finally relative dates and optional snapping are supported using the splunk syntax.
    ol
      li Begin string with a plus (+) or minus (-) to indicate the offset from the current time.
      li Define time amount with a number and a unit; the supported time units are:
        ul
          li second: s, sec, secs, second, seconds
          li minute: m, min, minute, minutes
          li hour: h, hr, hrs, hour, hours
          li day: d, day, days
          li week: w, week, weeks
          li month: mon, month, months
          li quarter: q, qtr, qtrs, quarter, quarters
          li year: y, yr, yrs, year, years
      li Optionally  specify a "snap to" time unit; this indicates the nearest or latest time to which the time amount rounds down. Separate the time amount from the "snap to" time unit with an "@" character
    h2 All supported fields
    table(border=1)
      tr
        th Name
        th Operators
        th Data type
        th What?
      each value in fieldsArr
        tr
          td #{value.exp}
          td #{operator[value.type]}
          td #{datatype[value.type]}
          td #{value.help}

    h2 Examples
    p 1) Find all the sessions involving RUS or CHN and on port 80 and the hostname contains com
    code (country == rus || country == chn) && port == 80 && host == *com
    p 2) Context type of text/plain, involving Canda, and less then 20 packets
    code tags == "http:content:text/plain" && country == CAN && packets < 20
