We are trying to find large numbers (1,000-10,000) of pcap files for both discreet individual malicious network events as well as pcaps for "normal" network traffic. We have been using metasploit and wireshark but are looking to extend the breadth and depth of the library we use for testing. Are there any repositories that would contain that many pcaps of individual events, or companies that specialize in capturing that kind of data? Thanks in advance, asked 09 Mar '17, 06:34  dougv |
One Answer:
Not that many files that I know of - this sounds like you're trying to train a software with bad and normal traffic. Problem is, that network captures are almost always sensitive in nature, so nobody is just capturing tons of them and providing them to the public... so you're probably stuck with smaller sets of files on the various sites that publish them; a good starter page (which you probably already know) is http://www.netresec.com/?page=PcapFiles answered 09 Mar '17, 06:48  Jasper ♦♦ |
Yes Jasper... that's exactly the purpose. We've pulled all the ones on sites like netresec and are now looking to broaden the sample size we are using for each "event" (normal vs. malicious). I figured if anyone was doing it in the quantities that would be useful for us, that it would be in a lab environment. Thanks for info.
I was going to suggest pcapr, but they don't allow commercial reuse.