Help Net Security has reached out to him for more information, and we will update this item when he gets back to us.Īs it turns out, Becker has been working on PacketTotal for the past year and a half, and has had a ton of fun building it. He also says that he has big plans for this project and more improvements in the pipeline. More details about what information the tool captures and potentially shares with vendors within the security industry, educational and private institutions, or other third parties can be found in the site’s Privacy Policy.īecker advises users to redact any information they don’t want to share with a. “The tool was intended for packet-captures generated within sandboxed environments, ensuring that no potentially confidential information is exposed. “Before you start analyzing packet captures it is important to remember that once analysis has started the information within the packet capture file becomes available to the Internet,” he warned. The author is Jamin Becker, and his main goal is to allow open intel sharing of malicious packet-captures accross the infosec community. The found artifacts can also be downloaded. Things like: artifacts inside the packet capture, TCP, UDP, and ICMP connections within the capture, protocols, etc. PacketTotal is meant to provide security analysts and researchers with useful information in a matter of minutes. Elasticsearch for indexing packet-capture meta-data, and making it available for search and rendering in the future.Suricata IDS for signature based identification of known malicious traffic within the capture.BRO IDS for identifying the various protocols and extracting artifacts found within the capture.

PacketTotal is a free tool for analyzing packet captures that has recently been offered to the infosec community.Īvailable online, the tool is powered by a Python-based engine and uses several open source technologies:

Online wireshark pcap viewer