Talk shit about AI all you want, but it makes digging through pcaps SOOO much easier
November 9, 2026 at 9:59 PM
Talk shit about AI all you want, but it makes digging through pcaps SOOO much easier
Trump is now reposting the 15% band thing.
Funny to see how they are putting the whole band back together on X. Lindell, Colbeck, Piton, Clements, Byrne, Lake...
How long before they trot out Dennis Montgomery, the Kraken and the PCAPs again?
Funny to see how they are putting the whole band back together on X. Lindell, Colbeck, Piton, Clements, Byrne, Lake...
How long before they trot out Dennis Montgomery, the Kraken and the PCAPs again?
November 7, 2026 at 10:42 PM
Trump is now reposting the 15% band thing.
Funny to see how they are putting the whole band back together on X. Lindell, Colbeck, Piton, Clements, Byrne, Lake...
How long before they trot out Dennis Montgomery, the Kraken and the PCAPs again?
Funny to see how they are putting the whole band back together on X. Lindell, Colbeck, Piton, Clements, Byrne, Lake...
How long before they trot out Dennis Montgomery, the Kraken and the PCAPs again?
Stop obsessing over certs and start building a home lab. You can’t defend a network if you don't know how to break one. Pro-tip: Learn to read PCAPs manually before relying on automated tools. Theory is nice, practice is everything. #InfoSec #CyberCareer
November 1, 2026 at 5:23 PM
Stop obsessing over certs and start building a home lab. You can’t defend a network if you don't know how to break one. Pro-tip: Learn to read PCAPs manually before relying on automated tools. Theory is nice, practice is everything. #InfoSec #CyberCareer
@malware-traffic-analysis.net Hi Brad, thanks for the recent AMOS Stealer pcaps and notes. I put together a packet-by-packet dissection that might complement them:
pmorningstar98.github.io/Parth-Jamodk...
Appreciate all the resources you share!
pmorningstar98.github.io/Parth-Jamodk...
Appreciate all the resources you share!
Dissecting an AMOS Stealer infection, packet by packet
pmorningstar98.github.io
October 25, 2026 at 8:07 PM
@malware-traffic-analysis.net Hi Brad, thanks for the recent AMOS Stealer pcaps and notes. I put together a packet-by-packet dissection that might complement them:
pmorningstar98.github.io/Parth-Jamodk...
Appreciate all the resources you share!
pmorningstar98.github.io/Parth-Jamodk...
Appreciate all the resources you share!
SO-CRATES 5.0 is out 🧅
SO-CRATES is a free, open source web app for analyzing PCAPs, logs, emails and binaries, all in one container that works offline.
New in 5.0: tshark runs alongside Suricata and provides additional protocol support. A new Findings tab ranks what those records show.
SO-CRATES is a free, open source web app for analyzing PCAPs, logs, emails and binaries, all in one container that works offline.
New in 5.0: tshark runs alongside Suricata and provides additional protocol support. A new Findings tab ranks what those records show.
October 25, 2026 at 7:36 PM
SO-CRATES 5.0 is out 🧅
SO-CRATES is a free, open source web app for analyzing PCAPs, logs, emails and binaries, all in one container that works offline.
New in 5.0: tshark runs alongside Suricata and provides additional protocol support. A new Findings tab ranks what those records show.
SO-CRATES is a free, open source web app for analyzing PCAPs, logs, emails and binaries, all in one container that works offline.
New in 5.0: tshark runs alongside Suricata and provides additional protocol support. A new Findings tab ranks what those records show.
Most SOC training uses scripted alerts and pregen'd PCAPs
Want something different?
Go to First Watch: Live SOC Threat Hunting Against Real Internet Attack Traffic
Oct 30th #BSidesNoVA
Teacher @tywilson21.bsky.social
bsidesnova-2026.sessionize.com/session/1321...
www.eventbrite.com/e/bsidesnova...
Want something different?
Go to First Watch: Live SOC Threat Hunting Against Real Internet Attack Traffic
Oct 30th #BSidesNoVA
Teacher @tywilson21.bsky.social
bsidesnova-2026.sessionize.com/session/1321...
www.eventbrite.com/e/bsidesnova...
First Watch: Live SOC Threat Hunting Against Real Internet Attack Traffic
Most SOC training runs on canned PCAPs and scripted alerts — you already know what you're supposed to find before you open the SIEM. First Watch doesn't work that way. It's a live Splunk environment f...
bsidesnova-2026.sessionize.com
October 23, 2026 at 4:04 PM
Most SOC training uses scripted alerts and pregen'd PCAPs
Want something different?
Go to First Watch: Live SOC Threat Hunting Against Real Internet Attack Traffic
Oct 30th #BSidesNoVA
Teacher @tywilson21.bsky.social
bsidesnova-2026.sessionize.com/session/1321...
www.eventbrite.com/e/bsidesnova...
Want something different?
Go to First Watch: Live SOC Threat Hunting Against Real Internet Attack Traffic
Oct 30th #BSidesNoVA
Teacher @tywilson21.bsky.social
bsidesnova-2026.sessionize.com/session/1321...
www.eventbrite.com/e/bsidesnova...
Just a reminder that tcpdump101.com is fully client-side. No #PHP at all. You can download it and run it locally on your computer without needing a server. For free.
tcpdump101.com - Build Packet Captures Online
Build PCaps for: tcpdump, Fortigate, Check Point 'fw monitor' and Cisco ASA.
tcpdump101.com
October 21, 2026 at 3:50 PM
Just a reminder that tcpdump101.com is fully client-side. No #PHP at all. You can download it and run it locally on your computer without needing a server. For free.
NETCONF runs inside SSH on TCP/830, so tcpdump shows only encrypted SSH records. Decode the XML with an SSH key in Wireshark's dissector or pipe pcaps to tshark. https://www.valtersit.com/vault/capture-and-decode-netconf-traffic-with-tcpdump-and-wireshar-a1bde2/
Capture and Decode NETCONF Traffic with tcpdump and Wireshark
www.valtersit.com
October 21, 2026 at 7:10 PM
NETCONF runs inside SSH on TCP/830, so tcpdump shows only encrypted SSH records. Decode the XML with an SSH key in Wireshark's dissector or pipe pcaps to tshark. https://www.valtersit.com/vault/capture-and-decode-netconf-traffic-with-tcpdump-and-wireshar-a1bde2/
It's a lot of that stuff doesn't bother me as long as it doesn't have a phone home aspect and that's the part I don't trust.
I have zero trust as to what they do with that data I don't believe them when they tell me what they do with that data
I need to see pcaps proving that my data isn't leaking
I have zero trust as to what they do with that data I don't believe them when they tell me what they do with that data
I need to see pcaps proving that my data isn't leaking
October 14, 2026 at 8:11 PM
It's a lot of that stuff doesn't bother me as long as it doesn't have a phone home aspect and that's the part I don't trust.
I have zero trust as to what they do with that data I don't believe them when they tell me what they do with that data
I need to see pcaps proving that my data isn't leaking
I have zero trust as to what they do with that data I don't believe them when they tell me what they do with that data
I need to see pcaps proving that my data isn't leaking
Best External SSDs for Kali Linux, Cybersecurity Labs & Ethical Hacking in 2026
Your Laptop's Storage Is Not Enough for a Serious Cybersecurity Lab A cybersecurity lab has a storage problem. It starts innocently. You install Kali Linux. Then Windows 11 in a VM. Then Ubuntu. Then Metasploitable.…
Your Laptop's Storage Is Not Enough for a Serious Cybersecurity Lab A cybersecurity lab has a storage problem. It starts innocently. You install Kali Linux. Then Windows 11 in a VM. Then Ubuntu. Then Metasploitable.…
Best External SSDs for Kali Linux, Cybersecurity Labs & Ethical Hacking in 2026
Your Laptop's Storage Is Not Enough for a Serious Cybersecurity Lab A cybersecurity lab has a storage problem. It starts innocently. You install Kali Linux. Then Windows 11 in a VM. Then Ubuntu. Then Metasploitable. Then Security Onion. Then a few CTF environments. Then Burp Suite projects. Then Wireshark PCAPs. Then ISO files. Then malware-analysis datasets. Then forensic disk images. Then backups. And suddenly your laptop says: Low disk space. If you've ever tried running multiple virtual machines from a laptop with a nearly full SSD, you already know how painful it can be.
spyboy.blog
October 14, 2026 at 5:07 PM
Best External SSDs for Kali Linux, Cybersecurity Labs & Ethical Hacking in 2026
Your Laptop's Storage Is Not Enough for a Serious Cybersecurity Lab A cybersecurity lab has a storage problem. It starts innocently. You install Kali Linux. Then Windows 11 in a VM. Then Ubuntu. Then Metasploitable.…
Your Laptop's Storage Is Not Enough for a Serious Cybersecurity Lab A cybersecurity lab has a storage problem. It starts innocently. You install Kali Linux. Then Windows 11 in a VM. Then Ubuntu. Then Metasploitable.…
"pcaps or it didn't happen" of course, but it's definitely something to look for other instances showing up.
October 5, 2026 at 6:00 PM
"pcaps or it didn't happen" of course, but it's definitely something to look for other instances showing up.
Cisco 200-201 CCNACBR prep shouldn’t be just memorization. Build skill with logs, PCAPs, host evidence, monitoring and incident response. This guide maps the exam domains + an 8-week study plan
<a href="https://www.peopledumps.com/blog/cisco-200-201-ccnacbr-exam-guide/" class="hover:underline text-blue-600 dark:text-sky-400 no-card-link" target="_blank" rel="noopener" data-link="bsky">https://www.peopledumps.com/blog/cisco-200-201-ccnacbr-exam-guide/
<a href="https://www.peopledumps.com/blog/cisco-200-201-ccnacbr-exam-guide/" class="hover:underline text-blue-600 dark:text-sky-400 no-card-link" target="_blank" rel="noopener" data-link="bsky">https://www.peopledumps.com/blog/cisco-200-201-ccnacbr-exam-guide/
October 5, 2026 at 1:00 AM
Cisco 200-201 CCNACBR prep shouldn’t be just memorization. Build skill with logs, PCAPs, host evidence, monitoring and incident response. This guide maps the exam domains + an 8-week study plan
<a href="https://www.peopledumps.com/blog/cisco-200-201-ccnacbr-exam-guide/" class="hover:underline text-blue-600 dark:text-sky-400 no-card-link" target="_blank" rel="noopener" data-link="bsky">https://www.peopledumps.com/blog/cisco-200-201-ccnacbr-exam-guide/
<a href="https://www.peopledumps.com/blog/cisco-200-201-ccnacbr-exam-guide/" class="hover:underline text-blue-600 dark:text-sky-400 no-card-link" target="_blank" rel="noopener" data-link="bsky">https://www.peopledumps.com/blog/cisco-200-201-ccnacbr-exam-guide/
Op says this is what is used at home.
Why doesn't anyone anymore show proof of their setup? Remember in the day folks would get roasted not showing pcaps of what they say is true and works.
Why doesn't anyone anymore show proof of their setup? Remember in the day folks would get roasted not showing pcaps of what they say is true and works.
October 4, 2026 at 3:58 AM
Op says this is what is used at home.
Why doesn't anyone anymore show proof of their setup? Remember in the day folks would get roasted not showing pcaps of what they say is true and works.
Why doesn't anyone anymore show proof of their setup? Remember in the day folks would get roasted not showing pcaps of what they say is true and works.
Don't forget that tcpdump101.com is around for all your PCap building needs. It's 100% client-side so you can download it and run it locally without a server on your PC.
I'm planning on starting work again on the next version once my house-stuff is done, likely later this year or early 2027. 💚
I'm planning on starting work again on the next version once my house-stuff is done, likely later this year or early 2027. 💚
tcpdump101.com - Build Packet Captures Online
Build PCaps for: tcpdump, Fortigate, Check Point 'fw monitor' and Cisco ASA.
tcpdump101.com
September 29, 2026 at 3:15 PM
Don't forget that tcpdump101.com is around for all your PCap building needs. It's 100% client-side so you can download it and run it locally without a server on your PC.
I'm planning on starting work again on the next version once my house-stuff is done, likely later this year or early 2027. 💚
I'm planning on starting work again on the next version once my house-stuff is done, likely later this year or early 2027. 💚
SO-CRATES 4.2.0 is live!
The single-container analyzer for PCAPs, logs, and binaries just got sharper, safer, and a lot nicer to live in.
The single-container analyzer for PCAPs, logs, and binaries just got sharper, safer, and a lot nicer to live in.
September 21, 2026 at 5:33 PM
SO-CRATES 4.2.0 is live!
The single-container analyzer for PCAPs, logs, and binaries just got sharper, safer, and a lot nicer to live in.
The single-container analyzer for PCAPs, logs, and binaries just got sharper, safer, and a lot nicer to live in.
Pro-tip: Master "normal." You can't spot a threat if you don't know what standard RPC or Kerberos traffic looks like. Build a home lab, analyze the PCAPs, and document the "why." That’s how you actually get hired. 🛡️
#BlueTeam #CyberSecurity #SOC
#BlueTeam #CyberSecurity #SOC
September 20, 2026 at 12:24 PM
Pro-tip: Master "normal." You can't spot a threat if you don't know what standard RPC or Kerberos traffic looks like. Build a home lab, analyze the PCAPs, and document the "why." That’s how you actually get hired. 🛡️
#BlueTeam #CyberSecurity #SOC
#BlueTeam #CyberSecurity #SOC
Thanks! 🏆 The real win is spotting that first outlier in a sea of "normal." If you're diving into those PCAPs and get stuck, feel free to reach out. Happy labbing! 🛡️
September 20, 2026 at 2:17 PM
Thanks! 🏆 The real win is spotting that first outlier in a sea of "normal." If you're diving into those PCAPs and get stuck, feel free to reach out. Happy labbing! 🛡️
Aspiring security analyst? Stop grinding certs and start building.
Pro-tip: Analyze actual PCAPs or write a script to parse logs. Experience beats theory every time when you’re in the hot seat. Get hands-on.
#CyberSecurity #InfoSec #CareerTips
Pro-tip: Analyze actual PCAPs or write a script to parse logs. Experience beats theory every time when you’re in the hot seat. Get hands-on.
#CyberSecurity #InfoSec #CareerTips
September 19, 2026 at 8:27 PM
Aspiring security analyst? Stop grinding certs and start building.
Pro-tip: Analyze actual PCAPs or write a script to parse logs. Experience beats theory every time when you’re in the hot seat. Get hands-on.
#CyberSecurity #InfoSec #CareerTips
Pro-tip: Analyze actual PCAPs or write a script to parse logs. Experience beats theory every time when you’re in the hot seat. Get hands-on.
#CyberSecurity #InfoSec #CareerTips
Aspiring security analyst? Stop grinding certs and start building. Build a home lab, analyze real PCAPs, or contribute to open-source tools.
Pro-tip: GitHub repos beat resume bullets every time. Show, don’t just tell.
#CyberSecurity #InfoSec
Pro-tip: GitHub repos beat resume bullets every time. Show, don’t just tell.
#CyberSecurity #InfoSec
September 17, 2026 at 9:21 PM
Aspiring security analyst? Stop grinding certs and start building. Build a home lab, analyze real PCAPs, or contribute to open-source tools.
Pro-tip: GitHub repos beat resume bullets every time. Show, don’t just tell.
#CyberSecurity #InfoSec
Pro-tip: GitHub repos beat resume bullets every time. Show, don’t just tell.
#CyberSecurity #InfoSec
Pro-tip: Master the "why" behind the alert. Don't just close tickets; learn to read Sysmon logs and PCAPs manually. If you can explain a suspicious process tree, you’re already ahead of the pack. 🛡️
#BlueTeam #SOCAnalyst #CyberSecurity
#BlueTeam #SOCAnalyst #CyberSecurity
September 16, 2026 at 12:46 PM
Pro-tip: Master the "why" behind the alert. Don't just close tickets; learn to read Sysmon logs and PCAPs manually. If you can explain a suspicious process tree, you’re already ahead of the pack. 🛡️
#BlueTeam #SOCAnalyst #CyberSecurity
#BlueTeam #SOCAnalyst #CyberSecurity
We were able to obtain the two-stage malware, including PCAPS, and have it analyzed. The first stage is the typosquat package, which executes a Python-script to dump, base64-encrypt, and then upload to a webhook-site your local environment, including passwords etc.
September 14, 2026 at 1:00 PM
We were able to obtain the two-stage malware, including PCAPS, and have it analyzed. The first stage is the typosquat package, which executes a Python-script to dump, base64-encrypt, and then upload to a webhook-site your local environment, including passwords etc.
Aspiring security analysts: stop obsessing over certifications and start building. Build a home lab, analyze real PCAPs, and document your findings.
Pro-tip: GitHub is your new resume. Employers want to see how you think, not just your acronyms.
#InfoSec #CyberSecurity #Career
Pro-tip: GitHub is your new resume. Employers want to see how you think, not just your acronyms.
#InfoSec #CyberSecurity #Career
September 13, 2026 at 2:44 PM
Aspiring security analysts: stop obsessing over certifications and start building. Build a home lab, analyze real PCAPs, and document your findings.
Pro-tip: GitHub is your new resume. Employers want to see how you think, not just your acronyms.
#InfoSec #CyberSecurity #Career
Pro-tip: GitHub is your new resume. Employers want to see how you think, not just your acronyms.
#InfoSec #CyberSecurity #Career
Is there a way you can have staff get packet captures at the gateway, or is NetBoot on the same network segment? Given that it you can do it on your office, I’m guessing it’s remote and pcaps would tell the issue pretty quick I bet.
September 10, 2026 at 10:02 PM
Is there a way you can have staff get packet captures at the gateway, or is NetBoot on the same network segment? Given that it you can do it on your office, I’m guessing it’s remote and pcaps would tell the issue pretty quick I bet.
OSI = teaching map. TCP/IP = what the internet runs: 4 layers.
• Application (5+6+7): HTTP, DNS, SSH
• Transport: TCP, UDP
• Internet: IP, ICMP
• Network Access: Ethernet, Wi-Fi, MAC
Investigators read PCAPs layer by layer
Full log cypherlogsec.blogspot.com
#InfoSec #CyberSecurity
• Application (5+6+7): HTTP, DNS, SSH
• Transport: TCP, UDP
• Internet: IP, ICMP
• Network Access: Ethernet, Wi-Fi, MAC
Investigators read PCAPs layer by layer
Full log cypherlogsec.blogspot.com
#InfoSec #CyberSecurity
September 9, 2026 at 4:03 PM
OSI = teaching map. TCP/IP = what the internet runs: 4 layers.
• Application (5+6+7): HTTP, DNS, SSH
• Transport: TCP, UDP
• Internet: IP, ICMP
• Network Access: Ethernet, Wi-Fi, MAC
Investigators read PCAPs layer by layer
Full log cypherlogsec.blogspot.com
#InfoSec #CyberSecurity
• Application (5+6+7): HTTP, DNS, SSH
• Transport: TCP, UDP
• Internet: IP, ICMP
• Network Access: Ethernet, Wi-Fi, MAC
Investigators read PCAPs layer by layer
Full log cypherlogsec.blogspot.com
#InfoSec #CyberSecurity