At least I didn't get puked on today.
I wish I could say the same thing for NFS.
I wish I could say the same thing for NFS.
December 7, 2025 at 3:12 PM
At least I didn't get puked on today.
I wish I could say the same thing for NFS.
I wish I could say the same thing for NFS.
I’ve talked in the past about doing psychophysics/eyetracking on experienced network security people pgdn’ing pcaps, seems kinda similar
September 11, 2024 at 8:18 PM
I’ve talked in the past about doing psychophysics/eyetracking on experienced network security people pgdn’ing pcaps, seems kinda similar
February 19, 2025 at 10:28 PM
Almost 40 years in Net/Sec/Eng and always willing to give back. #Networking, #Firewalls, #Hacking, #Linux, #Security, #Architecture and more. Don't want to connect yet? No biggie. Have yourself some tcpdump101.com to get started on building PCaps on a variety of platforms. 💚
#CyberMentoringMonday
#CyberMentoringMonday
tcpdump101.com - Build Packet Captures Online
Build PCaps for: tcpdump, Fortigate, Check Point 'fw monitor' and Cisco ASA.
tcpdump101.com
March 2, 2026 at 5:07 PM
Almost 40 years in Net/Sec/Eng and always willing to give back. #Networking, #Firewalls, #Hacking, #Linux, #Security, #Architecture and more. Don't want to connect yet? No biggie. Have yourself some tcpdump101.com to get started on building PCaps on a variety of platforms. 💚
#CyberMentoringMonday
#CyberMentoringMonday
This race would have SO many PCAPs
February 3, 2026 at 4:06 AM
This race would have SO many PCAPs
Pro-tip: Master "normal." You can't spot a threat if you don't know what standard RPC or Kerberos traffic looks like. Build a home lab, analyze the PCAPs, and document the "why." That’s how you actually get hired. 🛡️
#BlueTeam #CyberSecurity #SOC
#BlueTeam #CyberSecurity #SOC
September 20, 2026 at 12:24 PM
Pro-tip: Master "normal." You can't spot a threat if you don't know what standard RPC or Kerberos traffic looks like. Build a home lab, analyze the PCAPs, and document the "why." That’s how you actually get hired. 🛡️
#BlueTeam #CyberSecurity #SOC
#BlueTeam #CyberSecurity #SOC
2025-01-31 (Friday): Two pcaps with traffic of AgentTesla-style data exfil. One #pcap has FTP exfil, while the other has SMTP exfil. Pcaps are available at www.malware-traffic-analysis.net/2025/01/31/i...
January 31, 2025 at 9:26 PM
2025-01-31 (Friday): Two pcaps with traffic of AgentTesla-style data exfil. One #pcap has FTP exfil, while the other has SMTP exfil. Pcaps are available at www.malware-traffic-analysis.net/2025/01/31/i...
(my bet is on the ISP end or Itch's end but I can't make that conclusion or even guess knowledgeably without PCAPs and I don't think it's worth PCAPs if using a VPN works)
August 4, 2025 at 6:34 PM
(my bet is on the ISP end or Itch's end but I can't make that conclusion or even guess knowledgeably without PCAPs and I don't think it's worth PCAPs if using a VPN works)
Thats alot of words and no photos, usb pcaps or hashes
January 10, 2025 at 8:53 PM
Thats alot of words and no photos, usb pcaps or hashes
Pro-tip: Stop drowning in PCAPs. Use 'IO Graphs' to spot rhythmic C2 beaconing or spike patterns visually before you ever touch a filter. It’s like an X-ray for your traffic flow. 🕵️♂️💻
#Wireshark #NetworkDefense #InfoSec
#Wireshark #NetworkDefense #InfoSec
May 13, 2026 at 4:19 PM
Pro-tip: Stop drowning in PCAPs. Use 'IO Graphs' to spot rhythmic C2 beaconing or spike patterns visually before you ever touch a filter. It’s like an X-ray for your traffic flow. 🕵️♂️💻
#Wireshark #NetworkDefense #InfoSec
#Wireshark #NetworkDefense #InfoSec
Now you can simply drag PCAPs, stream files and session files into Ostinato -
January 3, 2025 at 7:22 AM
Now you can simply drag PCAPs, stream files and session files into Ostinato -
If anyone tries to tell you, CCIE or not, that the election was stolen, tell them PCAPS or GTFO.
November 11, 2024 at 11:52 PM
If anyone tries to tell you, CCIE or not, that the election was stolen, tell them PCAPS or GTFO.
Packet Analysis is fun and I am certainly enjoying deep dives into WLAN Frame Analysis.
Wireless PCAP I/O Graph Analyzer - v3.2.0 added another anomaly detection Retry Rate Analysis.
#pcaps #wifi #troubleshooting #frameanalysis #learning #anomalydetection
NOTE: Larger files may generate an error
Wireless PCAP I/O Graph Analyzer - v3.2.0 added another anomaly detection Retry Rate Analysis.
#pcaps #wifi #troubleshooting #frameanalysis #learning #anomalydetection
NOTE: Larger files may generate an error
April 10, 2026 at 2:30 PM
Packet Analysis is fun and I am certainly enjoying deep dives into WLAN Frame Analysis.
Wireless PCAP I/O Graph Analyzer - v3.2.0 added another anomaly detection Retry Rate Analysis.
#pcaps #wifi #troubleshooting #frameanalysis #learning #anomalydetection
NOTE: Larger files may generate an error
Wireless PCAP I/O Graph Analyzer - v3.2.0 added another anomaly detection Retry Rate Analysis.
#pcaps #wifi #troubleshooting #frameanalysis #learning #anomalydetection
NOTE: Larger files may generate an error
Huh. We don't expose underlying BGP stuff in our platform but we do have all the PCAPs from our global observation grid. Some really odd things started happening back on the 22nd
June 12, 2025 at 8:04 PM
Huh. We don't expose underlying BGP stuff in our platform but we do have all the PCAPs from our global observation grid. Some really odd things started happening back on the 22nd
Aspiring security analyst? Stop grinding certs and start building. Build a home lab, analyze real PCAPs, or contribute to open-source tools.
Pro-tip: GitHub repos beat resume bullets every time. Show, don’t just tell.
#CyberSecurity #InfoSec
Pro-tip: GitHub repos beat resume bullets every time. Show, don’t just tell.
#CyberSecurity #InfoSec
September 17, 2026 at 9:21 PM
Aspiring security analyst? Stop grinding certs and start building. Build a home lab, analyze real PCAPs, or contribute to open-source tools.
Pro-tip: GitHub repos beat resume bullets every time. Show, don’t just tell.
#CyberSecurity #InfoSec
Pro-tip: GitHub repos beat resume bullets every time. Show, don’t just tell.
#CyberSecurity #InfoSec
Why pcaps are not text files.
Kinda blowing my mind that we're still largely using text-based formats (JSON) for logging, rather than binary formats. Such as waste of compute resources.
January 27, 2025 at 3:44 PM
Why pcaps are not text files.
Shout out to text2pcap for letting me make up a PCAP for processing (and thus nullifying “pcaps or it didn’t happen” sentiment)
January 24, 2025 at 7:21 PM
Shout out to text2pcap for letting me make up a PCAP for processing (and thus nullifying “pcaps or it didn’t happen” sentiment)
I can only read pcaps while wearing the Shark Hat
a stuffed shark in a suit and tie holds a small boat
ALT: a stuffed shark in a suit and tie holds a small boat
media.tenor.com
May 6, 2026 at 2:20 AM
I can only read pcaps while wearing the Shark Hat
Aspiring security analyst? Stop grinding certs and start building.
Pro-tip: Analyze actual PCAPs or write a script to parse logs. Experience beats theory every time when you’re in the hot seat. Get hands-on.
#CyberSecurity #InfoSec #CareerTips
Pro-tip: Analyze actual PCAPs or write a script to parse logs. Experience beats theory every time when you’re in the hot seat. Get hands-on.
#CyberSecurity #InfoSec #CareerTips
September 19, 2026 at 8:27 PM
Aspiring security analyst? Stop grinding certs and start building.
Pro-tip: Analyze actual PCAPs or write a script to parse logs. Experience beats theory every time when you’re in the hot seat. Get hands-on.
#CyberSecurity #InfoSec #CareerTips
Pro-tip: Analyze actual PCAPs or write a script to parse logs. Experience beats theory every time when you’re in the hot seat. Get hands-on.
#CyberSecurity #InfoSec #CareerTips
I recently completed a long-term project to deindex old web pages on my blog, and I can now turn my attention back to sharing pcaps and malware samples.
I've posted 3 for December 2025, and I hope to get some more posted before the end of the year.
www.malware-traffic-analysis.net/2025/index.h...
I've posted 3 for December 2025, and I hope to get some more posted before the end of the year.
www.malware-traffic-analysis.net/2025/index.h...
December 22, 2025 at 6:09 AM
I recently completed a long-term project to deindex old web pages on my blog, and I can now turn my attention back to sharing pcaps and malware samples.
I've posted 3 for December 2025, and I hope to get some more posted before the end of the year.
www.malware-traffic-analysis.net/2025/index.h...
I've posted 3 for December 2025, and I hope to get some more posted before the end of the year.
www.malware-traffic-analysis.net/2025/index.h...
In case you missed the DEF CON talk on Rayhunter from me and oopsbagel here it is!
spectra.video/w/jt9rZHCU51...
spectra.video/w/jt9rZHCU51...
Rayhunter talk - DEFCON 33 - Recording PCAPs to detect Stingrays with a $20 hotspot
Spectra is a PeerTube instance dedicated to supporting original content creators, and building the video community within the fediverse!
spectra.video
August 17, 2025 at 2:16 AM
In case you missed the DEF CON talk on Rayhunter from me and oopsbagel here it is!
spectra.video/w/jt9rZHCU51...
spectra.video/w/jt9rZHCU51...
The packet doctors are in! @syn-bit.nl, Ross Bagurdes, and Chris Greer are analyzing pcaps from attendees that they’ve never seen before.
June 18, 2025 at 5:26 PM
The packet doctors are in! @syn-bit.nl, Ross Bagurdes, and Chris Greer are analyzing pcaps from attendees that they’ve never seen before.
SO-CRATES 4.2.0 is live!
The single-container analyzer for PCAPs, logs, and binaries just got sharper, safer, and a lot nicer to live in.
The single-container analyzer for PCAPs, logs, and binaries just got sharper, safer, and a lot nicer to live in.
September 21, 2026 at 5:33 PM
SO-CRATES 4.2.0 is live!
The single-container analyzer for PCAPs, logs, and binaries just got sharper, safer, and a lot nicer to live in.
The single-container analyzer for PCAPs, logs, and binaries just got sharper, safer, and a lot nicer to live in.
I gave it some pcaps, an exe and an apk and some steering, and it managed to rewrite almost all of 8bitdo's ultimate controller software in rust to be used on linux.
April 11, 2026 at 12:16 PM
I gave it some pcaps, an exe and an apk and some steering, and it managed to rewrite almost all of 8bitdo's ultimate controller software in rust to be used on linux.