Skip to content
Cloudflare API
Start here
API Reference
Magic Transit
PCAPs

Create PCAP request

magic_transit.pcaps.create(PCAPCreateParams**kwargs) -> PCAPCreateResponse
POST/accounts/{account_id}/pcaps

Create new PCAP request for account.

Security
API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
Accepted Permissions (at least one required)
Magic Firewall Packet Captures - Write PCAPs API
ParametersExpand Collapse
account_id: str

Identifier.

maxLength32
packet_limit: float

The limit of packets contained in a packet capture.

maximum10000
minimum1
system: Literal["magic-transit"]

The system used to collect packet captures.

time_limit: float

The packet capture duration in seconds.

maximum300
minimum1
type: Literal["simple", "full"]

The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following:
"simple"
"full"
filter_v1: Optional[PCAPFilterParam]

The packet capture filter. When this field is empty, all packets are captured.

destination_address: Optional[str]

The destination IP address of the packet.

destination_port: Optional[float]

The destination port of the packet.

protocol: Optional[float]

The protocol number of the packet.

source_address: Optional[str]

The source IP address of the packet.

source_port: Optional[float]

The source port of the packet.

offset_time: Optional[Union[str, datetime]]

The RFC 3339 offset timestamp from which to query backwards for packets. Must be within the last 24h. When this field is empty, defaults to time of request.

formatdate-time
ReturnsExpand Collapse
One of the following:
class PCAP: …
id: Optional[str]

The ID for the packet capture.

maxLength32
minLength32
filter_v1: Optional[PCAPFilter]

The packet capture filter. When this field is empty, all packets are captured.

destination_address: Optional[str]

The destination IP address of the packet.

destination_port: Optional[float]

The destination port of the packet.

protocol: Optional[float]

The protocol number of the packet.

source_address: Optional[str]

The source IP address of the packet.

source_port: Optional[float]

The source port of the packet.

offset_time: Optional[datetime]

The RFC 3339 offset timestamp from which to query backwards for packets. Must be within the last 24h. When this field is empty, defaults to time of request.

formatdate-time
status: Optional[Literal["unknown", "success", "pending", 5 more]]

The status of the packet capture request.

One of the following:
"unknown"
"success"
"pending"
"running"
"conversion_pending"
"conversion_running"
"complete"
"failed"
submitted: Optional[str]

The RFC 3339 timestamp when the packet capture was created.

system: Optional[Literal["magic-transit"]]

The system used to collect packet captures.

time_limit: Optional[float]

The packet capture duration in seconds.

maximum300
minimum1
type: Optional[Literal["simple", "full"]]

The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following:
"simple"
"full"
class MagicVisibilityPCAPsPCAPsResponseFull: …
id: Optional[str]

The ID for the packet capture.

maxLength32
minLength32
byte_limit: Optional[float]

The maximum number of bytes to capture. This field only applies to full packet captures.

maximum1000000000
minimum1
colo_name: Optional[str]

The name of the data center used for the packet capture. This can be a specific colo (ord02) or a multi-colo name (ORD). This field only applies to full packet captures.

destination_conf: Optional[str]

The full URI for the bucket. This field only applies to full packet captures.

error_message: Optional[str]

An error message that describes why the packet capture failed. This field only applies to full packet captures.

filter_v1: Optional[PCAPFilter]

The packet capture filter. When this field is empty, all packets are captured.

destination_address: Optional[str]

The destination IP address of the packet.

destination_port: Optional[float]

The destination port of the packet.

protocol: Optional[float]

The protocol number of the packet.

source_address: Optional[str]

The source IP address of the packet.

source_port: Optional[float]

The source port of the packet.

packets_captured: Optional[int]

The number of packets captured.

status: Optional[Literal["unknown", "success", "pending", 5 more]]

The status of the packet capture request.

One of the following:
"unknown"
"success"
"pending"
"running"
"conversion_pending"
"conversion_running"
"complete"
"failed"
stop_requested: Optional[datetime]

The RFC 3339 timestamp when stopping the packet capture was requested. This field only applies to full packet captures.

formatdate-time
submitted: Optional[str]

The RFC 3339 timestamp when the packet capture was created.

system: Optional[Literal["magic-transit"]]

The system used to collect packet captures.

time_limit: Optional[float]

The packet capture duration in seconds.

maximum86400
minimum1
type: Optional[Literal["simple", "full"]]

The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following:
"simple"
"full"

Create PCAP request

import os
from cloudflare import Cloudflare

client = Cloudflare(
    api_token=os.environ.get("CLOUDFLARE_API_TOKEN"),  # This is the default and can be omitted
)
pcap = client.magic_transit.pcaps.create(
    account_id="023e105f4ecef8ad9ca31a8372d0c353",
    packet_limit=10000,
    system="magic-transit",
    time_limit=300,
    type="simple",
)
print(pcap)
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "result": {
    "id": "66802ca5668e47a2b82c2e6746e45037",
    "filter_v1": {
      "destination_address": "1.2.3.4",
      "destination_port": 80,
      "protocol": 6,
      "source_address": "1.2.3.4",
      "source_port": 123
    },
    "offset_time": "2020-01-01T08:00:00Z",
    "status": "success",
    "submitted": "2020-01-01T08:00:00Z",
    "system": "magic-transit",
    "time_limit": 300,
    "type": "simple"
  },
  "success": true
}
Returns Examples
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "result": {
    "id": "66802ca5668e47a2b82c2e6746e45037",
    "filter_v1": {
      "destination_address": "1.2.3.4",
      "destination_port": 80,
      "protocol": 6,
      "source_address": "1.2.3.4",
      "source_port": 123
    },
    "offset_time": "2020-01-01T08:00:00Z",
    "status": "success",
    "submitted": "2020-01-01T08:00:00Z",
    "system": "magic-transit",
    "time_limit": 300,
    "type": "simple"
  },
  "success": true
}