Is there any tool or method to separate normal traffic and malicious traffic from pcap? For example : if malicious traffic detected with snort i need to store those packets .only if malicious traffic . Thanks for respond.
Instead of having Snort listen on an interface, you can give it a packet capture to read. Snort will read and analyze the packets as if they came off the wire.
This would help you understand the packets that Snort detected.
I understand this is an attempt to baseline your network, but in order to do so, you need to identify the applications and protocols that your business or agency depends upon. Catalog those; identify the servers, ports and acceptable client ranges. If you cannot identify what the mission depends upon and what is authorized to access those resources, then automated packet analysis will be at best a guess based on some notion of normal that has nothing to do with your organization.