topic PCAP On threats. in General Topics

PCAP On threats.

amansour — Thu, 07 Mar 2013 20:11:45 GMT

Can someone explain why PCAPs on threats would be useful or how to download?

Re: PCAP On threats.

Abs — Thu, 07 Mar 2013 20:15:49 GMT

You may want to check out this thread below for helpful answers. As always, searching before posting reduces clutter on forums.

What is the reason for packet capture?

(Now shamelessly accepting the next 51 friend requests.)

Re: PCAP On threats.

HITSSEC — Thu, 07 Mar 2013 23:07:26 GMT

If you are creating custom vulnerability signatures with multiple "or conditions" you like to know which condition triggers the signature. This helps for tuning and refining the signatures. This is in addition to those reasons listed in the thread mentioned above.

Phil

Re: PCAP On threats.

gswcowboy — Fri, 08 Mar 2013 15:12:05 GMT

Pcaps on threats detected can also assist our Content Team determine root cause on possible false positives.