Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I have been wondering exactly how does an IDS system use packet captures (PCAP) to process and alert of malicious signatures?

share|improve this question
2  
What do you mean? That's a bit of a technical question, not even all IDS will do it based on pcaps, it can also be on generated logs. – Lucas Kauffman Nov 17 '12 at 20:54
I was hoping for like an analogy or explanation of how a Network-based IDS would use packet captures (PCAP) to process and alert of malicious signatures? – OscarTheGrouch Nov 17 '12 at 21:18

1 Answer

up vote 1 down vote accepted

To answer your question: The IDS knows different protocols so it can see what runs over them. It can also interpret pcaps. A pcap is just a fileformat. The IDS understands this fileformat and can see all these different protocols. From here it just starts reading them. If it sees a protocol it understands, it will analyse it.

It's no different in concept than with logs, just different type of fileformat.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.