When you get to the level of analyzing packet data, the first obstacle is actually capturing the conversations that you may find relevant. While a capture filte

When you get to the level of analyzing packet data, the first obstacle is actually capturing the conversations that you may find relevant. While a capture filter can help on the acquisition, it is possible that an error in the filter could exclude relevant hosts, or ports, or protocols. In general wide open captures will then lead to very large capture files. Wireshark performs poorly with opening such a large trace. Since Engineer's are costing well north of $150 per hour, having them twiddle their thumbs waiting is not economical or efficient. Enabling a survey and filtering of the data as soon as possible from the pcap file will allow interactive examination. With Brim that identified data can be exported as a filtered, and thus much smaller file. This is similar to what tools such as Riverbed's Packet Analyzer do. PA is a .net front end to tshark type filtering and reporting. It ships with a number of useful filters to survey for common problems.[1] Brim and Zeek appear to fill the need between Packet Analyzer on one hand and a regular Wireshark workflow on the other. [1]: https://www.riverbed.com/products/steelcentral/steelcentral-packet-analyzer.html https://www.riverbed.com/products/steelcentral/steelcentral-...