Identifying, analyzing, and reporting malware incidents using packet captures

Have you ever wondered what your “smart toaster” was sending back to the internet about you? Or how your WiFi dog food dispenser knows your schedule? Our engineer Tom did, but he didn’t have a great way to capture the network traffic sent by mobile and IoT devices. So he turned a Raspberry Pi into a access point/network proxy capable of capturing packets and decrypting SSL within CloudShark, and now you can too. Keep reading

We put together some packet capture examples of Chris Wellons' (nullprogram.com) endlessh tarpit tool to trap would-be scan-bots trying to probe your server for vulnerabilities. Keep reading

The percent of encrypted web traffic has doubled between 2015 and 2019. In this article, you'll learn how to make the best use of packet captures for troubleshooting even when the information you need has been encrypted. Keep reading

We love building capture challenges, and in the process we learn a lot about networking, packets, and the tools that exist to manipulate and generate them. It took around seventy-five individual pcaps to deliver our Holiday challenge. Settle in as we get into the details of how we create it all. Keep reading

Watch our expert panel learn how experts approach challenges like these, using the right tools to uncover often deeply hidden problems. Read on to see what tools we use to build packet capture challenges like this. Keep reading

In depth on creating a capture challenge using custom built captures Every so often we like to come up with a special capture challenge where people can use CloudShark to dive into some packet analysis and find the solution. But often the interesting story is about the methods we use to make the captures themselves - generating and capturing very specific packets to make the challenge interesting. Being packet geeks, it’s also really fun. Keep reading

Cisco's Wi-Fi access points for small-to-medium business include integration to upload wireless captures to CloudShark. Keep reading

CloudShark Enterprise, is a packet capture repository, analysis tool, and collaboration platform that we built to solve the challenges faced in our own capture workflow. It uses Wireshark under the hood, but all you need is a web-browser. We believe that being able to quickly share packet analysis in context, without friction, and across teams, changes packet captures from something that are too often a “last resort” to a resource that can be relied on to provide answers faster than before. Keep reading

CloudShark has easy to use automatic presets to make your Wireless Analysis easier. Keep reading

Tracking down BitTorrent activity with packet captures We love the exercises at malware-traffic-analysis.net, and occasionally we’ll pick some that we try to solve using CloudShark and its tools. This time however, we’re going through one armed with tools that we learned from Brad’s class (the author of malware-traffic-analysis) at Sharkfest US 2018, where he gave an in-depth class on using packet captures for malware analysis, as well as a presentation on Analyzing Windows malware traffic. Keep reading