Category: pcap
Everything filed under pcap.
Your Logs Contain a Plea for Assistance In a Packet Bottle and You Likely Never Noticed It
PCAP forensics of the HMEFB worm: a self-propagating scanner with a Belarusian engineer's escape plea embedded in HTTP requests.
Reading PCAP Files (Directly) With DuckDB
2024-08-30 UPDATE: Binary versions of this extension are available for amd64 Linux ( linuxamd64 & linuxamd64gcc4 ) and Apple Silicon. ( osxarm64…
Acoustic: Solving a CyberDefenders PCAP SIP/RTP Challenge with R, Zeek, tshark (& friends)
Hot on the heels of the previous CyberDefenders Challenge Solution comes this noisy installment which solves their Acoustic…
Packet Maze: Solving a CyberDefenders PCAP Puzzle with R, Zeek, and tshark
It was a rainy weekend in southern Maine and I really didn't feel like doing chores, so I was skimming through RSS feeds and noticed a link to a PacketMaze challenge in the latest This Week In 4n6…
Reading PCAP Files with Apache Drill and the sergeant R Package
It's no secret that I'm a fan of Apache Drill . One big strength of the platform is that it normalizes the access to diverse data sources down to ANSI SQL calls, which means that I can pull data from parquet, Hie, HBase, Kudu, CSV, JSON,…