At least I didn't get puked on today.
I wish I could say the same thing for NFS.
I wish I could say the same thing for NFS.
December 7, 2025 at 3:12 PM
At least I didn't get puked on today.
I wish I could say the same thing for NFS.
I wish I could say the same thing for NFS.
I’ve talked in the past about doing psychophysics/eyetracking on experienced network security people pgdn’ing pcaps, seems kinda similar
September 11, 2024 at 8:18 PM
I’ve talked in the past about doing psychophysics/eyetracking on experienced network security people pgdn’ing pcaps, seems kinda similar
February 19, 2025 at 10:28 PM
Almost 40 years in Net/Sec/Eng and always willing to give back. #Networking, #Firewalls, #Hacking, #Linux, #Security, #Architecture and more. Don't want to connect yet? No biggie. Have yourself some tcpdump101.com to get started on building PCaps on a variety of platforms. 💚
#CyberMentoringMonday
#CyberMentoringMonday
tcpdump101.com - Build Packet Captures Online
Build PCaps for: tcpdump, Fortigate, Check Point 'fw monitor' and Cisco ASA.
tcpdump101.com
March 2, 2026 at 5:07 PM
Almost 40 years in Net/Sec/Eng and always willing to give back. #Networking, #Firewalls, #Hacking, #Linux, #Security, #Architecture and more. Don't want to connect yet? No biggie. Have yourself some tcpdump101.com to get started on building PCaps on a variety of platforms. 💚
#CyberMentoringMonday
#CyberMentoringMonday
This race would have SO many PCAPs
February 3, 2026 at 4:06 AM
This race would have SO many PCAPs
2025-01-31 (Friday): Two pcaps with traffic of AgentTesla-style data exfil. One #pcap has FTP exfil, while the other has SMTP exfil. Pcaps are available at www.malware-traffic-analysis.net/2025/01/31/i...
January 31, 2025 at 9:26 PM
2025-01-31 (Friday): Two pcaps with traffic of AgentTesla-style data exfil. One #pcap has FTP exfil, while the other has SMTP exfil. Pcaps are available at www.malware-traffic-analysis.net/2025/01/31/i...
(my bet is on the ISP end or Itch's end but I can't make that conclusion or even guess knowledgeably without PCAPs and I don't think it's worth PCAPs if using a VPN works)
August 4, 2025 at 6:34 PM
(my bet is on the ISP end or Itch's end but I can't make that conclusion or even guess knowledgeably without PCAPs and I don't think it's worth PCAPs if using a VPN works)
Thats alot of words and no photos, usb pcaps or hashes
January 10, 2025 at 8:53 PM
Thats alot of words and no photos, usb pcaps or hashes
Pro-tip: Stop drowning in PCAPs. Use 'IO Graphs' to spot rhythmic C2 beaconing or spike patterns visually before you ever touch a filter. It’s like an X-ray for your traffic flow. 🕵️♂️💻
#Wireshark #NetworkDefense #InfoSec
#Wireshark #NetworkDefense #InfoSec
May 13, 2026 at 4:19 PM
Pro-tip: Stop drowning in PCAPs. Use 'IO Graphs' to spot rhythmic C2 beaconing or spike patterns visually before you ever touch a filter. It’s like an X-ray for your traffic flow. 🕵️♂️💻
#Wireshark #NetworkDefense #InfoSec
#Wireshark #NetworkDefense #InfoSec
Now you can simply drag PCAPs, stream files and session files into Ostinato -
January 3, 2025 at 7:22 AM
Now you can simply drag PCAPs, stream files and session files into Ostinato -
If anyone tries to tell you, CCIE or not, that the election was stolen, tell them PCAPS or GTFO.
November 11, 2024 at 11:52 PM
If anyone tries to tell you, CCIE or not, that the election was stolen, tell them PCAPS or GTFO.
Packet Analysis is fun and I am certainly enjoying deep dives into WLAN Frame Analysis.
Wireless PCAP I/O Graph Analyzer - v3.2.0 added another anomaly detection Retry Rate Analysis.
#pcaps #wifi #troubleshooting #frameanalysis #learning #anomalydetection
NOTE: Larger files may generate an error
Wireless PCAP I/O Graph Analyzer - v3.2.0 added another anomaly detection Retry Rate Analysis.
#pcaps #wifi #troubleshooting #frameanalysis #learning #anomalydetection
NOTE: Larger files may generate an error
April 10, 2026 at 2:30 PM
Packet Analysis is fun and I am certainly enjoying deep dives into WLAN Frame Analysis.
Wireless PCAP I/O Graph Analyzer - v3.2.0 added another anomaly detection Retry Rate Analysis.
#pcaps #wifi #troubleshooting #frameanalysis #learning #anomalydetection
NOTE: Larger files may generate an error
Wireless PCAP I/O Graph Analyzer - v3.2.0 added another anomaly detection Retry Rate Analysis.
#pcaps #wifi #troubleshooting #frameanalysis #learning #anomalydetection
NOTE: Larger files may generate an error
Huh. We don't expose underlying BGP stuff in our platform but we do have all the PCAPs from our global observation grid. Some really odd things started happening back on the 22nd
June 12, 2025 at 8:04 PM
Huh. We don't expose underlying BGP stuff in our platform but we do have all the PCAPs from our global observation grid. Some really odd things started happening back on the 22nd
Why pcaps are not text files.
Kinda blowing my mind that we're still largely using text-based formats (JSON) for logging, rather than binary formats. Such as waste of compute resources.
January 27, 2025 at 3:44 PM
Why pcaps are not text files.
Shout out to text2pcap for letting me make up a PCAP for processing (and thus nullifying “pcaps or it didn’t happen” sentiment)
January 24, 2025 at 7:21 PM
Shout out to text2pcap for letting me make up a PCAP for processing (and thus nullifying “pcaps or it didn’t happen” sentiment)
I can only read pcaps while wearing the Shark Hat
a stuffed shark in a suit and tie holds a small boat
ALT: a stuffed shark in a suit and tie holds a small boat
media.tenor.com
May 6, 2026 at 2:20 AM
I can only read pcaps while wearing the Shark Hat
I recently completed a long-term project to deindex old web pages on my blog, and I can now turn my attention back to sharing pcaps and malware samples.
I've posted 3 for December 2025, and I hope to get some more posted before the end of the year.
www.malware-traffic-analysis.net/2025/index.h...
I've posted 3 for December 2025, and I hope to get some more posted before the end of the year.
www.malware-traffic-analysis.net/2025/index.h...
December 22, 2025 at 6:09 AM
I recently completed a long-term project to deindex old web pages on my blog, and I can now turn my attention back to sharing pcaps and malware samples.
I've posted 3 for December 2025, and I hope to get some more posted before the end of the year.
www.malware-traffic-analysis.net/2025/index.h...
I've posted 3 for December 2025, and I hope to get some more posted before the end of the year.
www.malware-traffic-analysis.net/2025/index.h...
In case you missed the DEF CON talk on Rayhunter from me and oopsbagel here it is!
spectra.video/w/jt9rZHCU51...
spectra.video/w/jt9rZHCU51...
Rayhunter talk - DEFCON 33 - Recording PCAPs to detect Stingrays with a $20 hotspot
Spectra is a PeerTube instance dedicated to supporting original content creators, and building the video community within the fediverse!
spectra.video
August 17, 2025 at 2:16 AM
In case you missed the DEF CON talk on Rayhunter from me and oopsbagel here it is!
spectra.video/w/jt9rZHCU51...
spectra.video/w/jt9rZHCU51...
The packet doctors are in! @syn-bit.nl, Ross Bagurdes, and Chris Greer are analyzing pcaps from attendees that they’ve never seen before.
June 18, 2025 at 5:26 PM
The packet doctors are in! @syn-bit.nl, Ross Bagurdes, and Chris Greer are analyzing pcaps from attendees that they’ve never seen before.
I gave it some pcaps, an exe and an apk and some steering, and it managed to rewrite almost all of 8bitdo's ultimate controller software in rust to be used on linux.
April 11, 2026 at 12:16 PM
I gave it some pcaps, an exe and an apk and some steering, and it managed to rewrite almost all of 8bitdo's ultimate controller software in rust to be used on linux.
Hi, I’m a security engineer
my greatest hits include:
- who owns this asset?
- there’s a policy stating the vulnerability should be fixed
- you have to actually remove the file, no, wrong directory
- ticket says work is complete but logs & pcaps state traffic to this scanner are still blocked
my greatest hits include:
- who owns this asset?
- there’s a policy stating the vulnerability should be fixed
- you have to actually remove the file, no, wrong directory
- ticket says work is complete but logs & pcaps state traffic to this scanner are still blocked
hi, I’m a platform security architect
my greatest hits include:
- does that line reference a data flow or network connection?
- i don’t approve anything
- you realize that design led to the breach that led to my hiring?
- how are we defining “secure”?
- let’s build it in house
- let’s buy it
my greatest hits include:
- does that line reference a data flow or network connection?
- i don’t approve anything
- you realize that design led to the breach that led to my hiring?
- how are we defining “secure”?
- let’s build it in house
- let’s buy it
May 31, 2024 at 10:25 PM
Hi, I’m a security engineer
my greatest hits include:
- who owns this asset?
- there’s a policy stating the vulnerability should be fixed
- you have to actually remove the file, no, wrong directory
- ticket says work is complete but logs & pcaps state traffic to this scanner are still blocked
my greatest hits include:
- who owns this asset?
- there’s a policy stating the vulnerability should be fixed
- you have to actually remove the file, no, wrong directory
- ticket says work is complete but logs & pcaps state traffic to this scanner are still blocked
For those of you who want to learn and run #PacketCaptures, make sure you check out tcpdump101.com to help build the command syntax for a variety of platforms. It's 100% client-side so feel free to download it and run it offline without needing a server. #HappyPacketHunting
tcpdump101.com - Build Packet Captures Online
Build PCaps for: tcpdump, Fortigate, Check Point 'fw monitor' and Cisco ASA.
tcpdump101.com
January 28, 2025 at 4:09 PM
For those of you who want to learn and run #PacketCaptures, make sure you check out tcpdump101.com to help build the command syntax for a variety of platforms. It's 100% client-side so feel free to download it and run it offline without needing a server. #HappyPacketHunting
it's so nice that wireshark can just open LTE RRC pcaps now! no extra config required
October 4, 2025 at 3:04 AM
it's so nice that wireshark can just open LTE RRC pcaps now! no extra config required
Figuring out Channel Widths is complicated. Took a while but I think I have been able to add 2.4, 5 and 6 GHz in there. After testing a few pcaps, I got good results back.
Let me know what do you think.
pcap-io-graph.artofrf.com
Let me know what do you think.
pcap-io-graph.artofrf.com
February 26, 2026 at 4:39 PM
Figuring out Channel Widths is complicated. Took a while but I think I have been able to add 2.4, 5 and 6 GHz in there. After testing a few pcaps, I got good results back.
Let me know what do you think.
pcap-io-graph.artofrf.com
Let me know what do you think.
pcap-io-graph.artofrf.com
Spent some time with #Wireshark - comparing captured traffic to baselines and cross-referencing #PCAPs with a friend who’s #Rayhunter was on the other side of the crowd
Happy to report that we’ve found no evidence of #Stingray #IMSIcatcher devices (yet)
Happy to report that we’ve found no evidence of #Stingray #IMSIcatcher devices (yet)
April 13, 2025 at 1:47 AM
Spent some time with #Wireshark - comparing captured traffic to baselines and cross-referencing #PCAPs with a friend who’s #Rayhunter was on the other side of the crowd
Happy to report that we’ve found no evidence of #Stingray #IMSIcatcher devices (yet)
Happy to report that we’ve found no evidence of #Stingray #IMSIcatcher devices (yet)