1

Is there any tool or method to separate normal traffic and malicious traffic from pcap? For example : if malicious traffic detected with snort i need to store those packets .only if malicious traffic . Thanks for respond.

7
  • 3
    Every way that is known to identify "normal" from "malicious" traffic already exists as rules in Snort and other intrusion detection systems. If malicious traffic was that easy to identify, it would be equally easy to block, and we wouldn't have malicious traffic. Therefore, there won't ever be such a tool or method. – John Deters Nov 28 '14 at 3:11
  • i captured for two days and i have 40gb packet.i want to separate some traffic that is malicious traffic detected with snort. sorry for my bad english. :)) – user30276 Nov 28 '14 at 3:52
  • 1
    Interesting question, and some IDS software (like Snort / Sourcefire) can ingest a PCAP, but that is not useful until you are understanding the applications and traffic that are legitimately in-use. – DTK Nov 28 '14 at 4:45
  • 1
    if malicious traffic detected with snort i need to store those packets. – user30276 Nov 28 '14 at 4:52
  • You want RFC 3514, which specifies a security flag for the IPv4 header, so as to easily distinguish malicious traffic. – Colin Valliant Nov 28 '14 at 9:55
0

Instead of having Snort listen on an interface, you can give it a packet capture to read. Snort will read and analyze the packets as if they came off the wire.

See http://manual.snort.org/node8.html

This would help you understand the packets that Snort detected.

1
  • i want to store packets which is include malicious code. – user30276 Nov 30 '14 at 5:58
0

I understand this is an attempt to baseline your network, but in order to do so, you need to identify the applications and protocols that your business or agency depends upon. Catalog those; identify the servers, ports and acceptable client ranges. If you cannot identify what the mission depends upon and what is authorized to access those resources, then automated packet analysis will be at best a guess based on some notion of normal that has nothing to do with your organization.

1
  • sorry for my bad english. if ($pcap==snort.signature(i mean it's malicious) then store this packet – user30276 Nov 30 '14 at 6:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.