I have a program that has to detect scanning activity of worms.

I need some samples of worms' traffic (pcap files) to try the program, and notes about the procedures which must be taken when running such files to keep my computer safe.

Are there any safe capture files that contain the scanning activity only without the worm payload? There is a sample capture for slammer worm at wireshark.org, but when I tried to open it I got a warning. What I should do in this case??

  • 2
    The Wireshark Wiki has some nice samples, two under Viruses and worms. – Henning Klevjer Dec 7 '12 at 12:38
  • Thanks a lot,yes ,as I mentioned in my question, I saw them but when I tried to open the file of slammer.pcap i've got a warning and I was afraid from open it, is there any procedures or measrements should be taken when work with these type of files,are they harmful to my pc? do you know further sites have these type of traffic? – leena Dec 7 '12 at 13:51
  • My first reaction is that your anti virus application alerts you that the contents look very much like the Slammer worm. Which really should leave no minds blown. You'll probably be safe. If you're scared, get yourself a Virtual Machine and a free operating system that supports Wireshark. If anything happens within the VM it is limited to the VM only. – Henning Klevjer Dec 7 '12 at 14:20
  • 2
    if you have a pcap already then there shouldn't be anything to be afraid of. If you're super paranoid though you can always using tshark to convert the pcap to plain text. – grauwulf Dec 7 '12 at 14:35
  • 1
    No more suggestions than trying to get infected and Wireshark it. – Henning Klevjer Dec 7 '12 at 17:44

Frankly, I would install VMs using Virtualbox and create a standalone internal network. Then, I would infect one machine with Slammer and capture the traffic.

If you are going to be doing security research, then you will need to set up a lab like this and get your hands dirty. Your learning will be so much better.

Good luck!


You could use a sandbox tool such as Cuckoo which will allow you to run your malware in a safe environment. This will provide a pcap file containing the resulting network traffic.

In terms of services out there that provide the pcap files for worms, I'm not aware of any. Malwr (which uses cuckoo) will give you an overview of some of the network traffic but not the whole file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.