Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been wondering exactly how does an IDS system use packet captures (PCAP) to process and alert of malicious signatures?

share|improve this question
What do you mean? That's a bit of a technical question, not even all IDS will do it based on pcaps, it can also be on generated logs. – Lucas Kauffman Nov 17 '12 at 20:54
I was hoping for like an analogy or explanation of how a Network-based IDS would use packet captures (PCAP) to process and alert of malicious signatures? – OscarTheGrouch Nov 17 '12 at 21:18
up vote 1 down vote accepted

To answer your question: The IDS knows different protocols so it can see what runs over them. It can also interpret pcaps. A pcap is just a fileformat. The IDS understands this fileformat and can see all these different protocols. From here it just starts reading them. If it sees a protocol it understands, it will analyse it.

It's no different in concept than with logs, just different type of fileformat.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.