Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been wondering exactly how does an IDS system use packet captures (PCAP) to process and alert of malicious signatures?

share|improve this question
2  
What do you mean? That's a bit of a technical question, not even all IDS will do it based on pcaps, it can also be on generated logs. –  Lucas Kauffman Nov 17 '12 at 20:54
    
I was hoping for like an analogy or explanation of how a Network-based IDS would use packet captures (PCAP) to process and alert of malicious signatures? –  OscarTheGrouch Nov 17 '12 at 21:18
add comment

1 Answer 1

up vote 1 down vote accepted

To answer your question: The IDS knows different protocols so it can see what runs over them. It can also interpret pcaps. A pcap is just a fileformat. The IDS understands this fileformat and can see all these different protocols. From here it just starts reading them. If it sees a protocol it understands, it will analyse it.

It's no different in concept than with logs, just different type of fileformat.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.