3 ms·
Typically not a literal pcap. Not just wireshsrk running persistently everywhere. There are systems you can buy (eg by Pico) that you mirror all traffic to and
by hnbear 2y ago
Typically not a literal pcap. Not just wireshsrk running persistently everywhere.
There are systems you can buy (eg by Pico) that you mirror all traffic to and they store it, index it, and have pre-configured parsers for a lot of protocols to make querying easier.
Think Splunk/ELK for network traffic by packet.
- hn_version_0023 2y agoThe Corvil devices used by Pico have IME largely been replaced by Arista 7130 Metamux platforms at the capture “edge”
- HolyLampshade 2y agoWhich is great for the companies that have made the switch because those corvils were truly terrible.
- cjalmeida 2y agoExcept it is literal “pcap” as they capture all packets at layer 3. I don’t know the exact specifications of Pico appliances, but it would not surprise me they’re running Linux + libpcap + some sort of timeseries DB
- hnbear 2y agoWell, probably, but I meant more like it's not typically someone running tcpdump everywhere and someone analyzing with Wireshark, rather than a systems configured to do this at scale across the desktop.
- kelnos 2y agoI don't think that's what anyone was assuming. A "pcap" is a file format for serialized network packets, not a particular application that generates them.