3 ms·
A suggested alternative is to use span pcap dumps of network environments that have viruses spreading through them (I used a few of them for a earlier project f
by dryicerx 17y ago
A suggested alternative is to use span pcap dumps of network environments that have viruses spreading through them (I used a few of them for a earlier project for worm detection), although I can't seem to find those website at the moment. But something to keep in mind. Try searching for Defcon packet dumps.
A added benefit would be replaying the same test environment repeatedly while tweaking your detectors parameters.
- deutronium 17y agoCheers, I'll check them out, I used to record PCAPs when I was using KVM's multicast network emulation, as it was easy to pick up all network traffic, its become more difficult using VDE, as I don't believe theres a way to record all traffic through a single tap interface.