Examples of the Endlessh tarpit script for server defense

The percent of encrypted web traffic has doubled between 2015 and 2019. In this article, you'll learn how to make the best use of packet captures for troubleshooting even when the information you need has been encrypted. Keep reading

We love building capture challenges, and in the process we learn a lot about networking, packets, and the tools that exist to manipulate and generate them. It took around seventy-five individual pcaps to deliver our Holiday challenge. Settle in as we get into the details of how we create it all. Keep reading

Watch our expert panel learn how experts approach challenges like these, using the right tools to uncover often deeply hidden problems. Read on to see what tools we use to build packet capture challenges like this. Keep reading

In depth on creating a capture challenge using custom built captures Every so often we like to come up with a special capture challenge where people can use CloudShark to dive into some packet analysis and find the solution. But often the interesting story is about the methods we use to make the captures themselves - generating and capturing very specific packets to make the challenge interesting. Being packet geeks, it’s also really fun. Keep reading

Cisco's Wi-Fi access points for small-to-medium business include integration to upload wireless captures to CloudShark. Keep reading

CloudShark Enterprise, is a packet capture repository, analysis tool, and collaboration platform that we built to solve the challenges faced in our own capture workflow. It uses Wireshark under the hood, but all you need is a web-browser. We believe that being able to quickly share packet analysis in context, without friction, and across teams, changes packet captures from something that are too often a “last resort” to a resource that can be relied on to provide answers faster than before. Keep reading

CloudShark has easy to use automatic presets to make your Wireless Analysis easier. Keep reading

Tracking down BitTorrent activity with packet captures We love the exercises at malware-traffic-analysis.net, and occasionally we’ll pick some that we try to solve using CloudShark and its tools. This time however, we’re going through one armed with tools that we learned from Brad’s class (the author of malware-traffic-analysis) at Sharkfest US 2018, where he gave an in-depth class on using packet captures for malware analysis, as well as a presentation on Analyzing Windows malware traffic. Keep reading

Part 3 of our series exploring TCP examines the TCP “Fast Open” option and what to look for when troubleshooting TCP Fast Open (TFO) is an optional mechanism within TCP that lets endpoints that have established a full TCP connection in the past eliminate a round-trip of the handshake and send data right away. This speeds things up for endpoints that are going to keep talking to each other in the future and is especially beneficial on high-latency networks where time-to-first-byte is critical. Keep reading

Network packet captures present an interesting problem for HIPAA compliance, but they don’t have to be one that causes headaches. When it comes to securing electronic assets, packet captures are often overlooked more than other network and IT related resources. This is because they tend to be esoteric - compliance officers don’t need or want to have packets on their minds. Also, the methods through which they are obtained trend towards creating local, unaccountable copies of the traffic going over your network. Keep reading