When planning a packet capture capability, it is important to allow time for optimizing what is captured and what is allowed to be summarized by other technologies. Realistically, even if it becomes important to watch for some odd reason, keeping the URL should be enough to fetch the video again from the content provider. Do you really need a complete copy of every streaming video that the employees have watched for the past three weeks? No. Judicious full-packet capture, rather than blanket capture, provides useful information. įull-packet capture remains an important tool for analysts, but it needs to be filtered before it is stored. Some flow meters provide the option to retain and index the pcap files when it processes packet capture to produce network flow. Broad queries can be done using flow tools, and then when more detail is needed all the packets that were part of the flow in question can be pulled out. Network flow particularly lends itself to this task, since it contains a condensed form of all the same data as full-packet capture. Most of the solutions to this problem involve using one of the OSI analysis levels as an index into the pcap itself. Searching through a large collection of pcap files has been likened to finding a needle in a needle-stack. Once packet capture data is stored, and assuming it has the desired data in an unencrypted format, it can still be challenging to find the important data. However, attackers can still obscure data from proxies, such as by encrypting or encoding the data twice. The proxy breaks the connection into two distinct connections, and since network encryption only protects data in transit and not at the endpoints, the proxy can observe it. In some cases this encryption can be avoided, such as by forcing the hosts on the network to use a proxy and simply having the proxy record the traffic in its unencrypted state. Attackers have taken this lesson as well, and often enough it is precisely the data that would make pcap valuable that is encrypted. Defenders advocate network encryption, such as discussed in Chapter 8. Unfortunately, network payload traffic is often obscured. On the other hand, packet capture is the only way to reconstruct the exact details of an attack, which makes it an important tool. Retention of sufficient packet capture data so that it can be analytically useful is a challenge. As discussed before, many if not most intrusions are not detected for weeks. A common corporate link of 10 gigabits could fill the same space in less than 14 minutes.

3 This is the most voluminous network analysis option even a rather modest 100-megabit link-a good and common residential connection in 2013-could fill up a terabyte of hard drive space in just 22 hours. The results are often colloquially referred to by their file extension: pcap. Spring, in Introduction to Information Security, 2014 Full-Packet Captureįull-packet capture is any technology that records every bit that goes over the wire for later inspection. The resulting pcap file is the same as if Snort had been run with the –b command-line option or the tcpdump output plug-in. Since the pcap file does not contain any of the alert information associated with the packet, the log_pcap output plug-in is most useful for extracting the packet data for analysis in another tool. It is important to remember that the timestamp only indicates when the file was created and does not necessarily represent the timestamps of any of the data in it. For example, if log_pcap is configured with the default settings and were to open an output file now (Thu Mar 18 21:44:), then the output file would be named 21-44-12. The timestamp indicates when the output file was created using the local time zone.

So, what happens if the output file already exists? To avoid overwriting any existing output file, Barnyard adds a timestamp extension to the filename. This is because a pcap file must include specific header information. The log_pcap output plug-in, however, will always create a new output file. So far, all of the output plug-ins that write to a file will append to the current file if it already exists. The output file for log_pcap differs a bit from the other file-based output plug-ins we have discussed.

If the filename option is not specified, then “barnyard.pcap” will be used.

Open pcap file wireshark command line