Where can I find worm traffic sample?

Question

I have a program that has to detect scanning activity of worms.

I need some samples of worms' traffic (pcap files) to try the program, and notes about the procedures which must be taken when running such files to keep my computer safe.

Are there any safe capture files that contain the scanning activity only without the worm payload? There is a sample capture for slammer worm at wireshark.org, but when I tried to open it I got a warning. What I should do in this case??

Answer 1

Frankly, I would install VMs using Virtualbox and create a standalone internal network. Then, I would infect one machine with Slammer and capture the traffic.

If you are going to be doing security research, then you will need to set up a lab like this and get your hands dirty. Your learning will be so much better.

Good luck!

Answer 2

You could use a sandbox tool such as Cuckoo which will allow you to run your malware in a safe environment. This will provide a pcap file containing the resulting network traffic.

In terms of services out there that provide the pcap files for worms, I'm not aware of any. Malwr (which uses cuckoo) will give you an overview of some of the network traffic but not the whole file.