Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I have 3 packet capture, generated with Wireshark, of an example intrusion but I'm struggling to figure out whats going on.

I also tried running the pcap files in snort to see if it detected anything but I'm not sure what the results were. I have never used snort before but the results didn't come out like I expected. That is, I expected it to output each malicious packet along with the suspected attack.

share|improve this question
My copy of Wireshark complained that these were not in a format it understood. – Jim In Texas Jul 3 '12 at 16:25
Have you tried to run them through Bro? The generated log files are quite comprehensive and may give you a clue. – Matthias Vallentin Jul 3 '12 at 17:07
Kirsty - a question has been raised in meta to discuss the implications of posting a full pcap, and to try and get a decision on how we want to handle them (as there are a few risks). Please have a look at meta.security.stackexchange.com/q/855/485 and see whether you can perhaps pull out just the key parts of the pcap or use some other means to limit the risk/exposure/information leakage – Rory Alsop♦ Jul 3 '12 at 21:37
What are you exactly looking for? I found a radiohead mp3 being uploaded, it's that what you were looking for? – Zzz Jul 3 '12 at 21:51
@JimInTexas maybe try update your wireshark? – Kirsty White Jul 4 '12 at 11:56
show 4 more comments

closed as not a real question by Rory Alsop♦ Jul 19 '12 at 6:58

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

Browse other questions tagged or ask your own question.