Differences

This shows you the differences between two versions of the page.

--- offline:defcon26ctf [2018/11/12 22:58] – [Retro Counters] veera
+++ offline:defcon26ctf [2018/11/12 23:00] (current) – [Port connections over time] veera
@@ Line 118: / Line 118: @@
 Select //Alerts > Show All > IDS// to show the IDS alert categories seen.  You can then click on an alert to drill down further or pull up PCAPs.
-{{:offline:dc26-6.png?600|}}
+{{:offline:dc26-6.png?800|}}
@@ Line 125: / Line 125: @@
 Trisul lets you seamlessly pivot from any analysis point to PCAPs. You can pull down entire PCAP or use the super nifty "PCAP Headers" to only see the top of the PCAP. In the PCAP headers, we show the 'strings' seen in the PCAP header, the actual Hexdump, and a TSHARK like packet summary.
-{{:offline:dc26-7.png?600|}}
+{{:offline:dc26-7.png?800|}}
@@ Line 133: / Line 133: @@
-{{:offline:dc26-8.png?600|}}
+{{:offline:dc26-8.png?800|}}
@@ Line 140: / Line 140: @@
 The last one here is quite interesting. Go to Retro Counters > Select the entire Time interval and then select "Apps".  We find that CTF contestants attacking different ports on different days. Hmm, maybe something to look deeper into.
-{{:offline:dc26-9.png?600|}}
+{{:offline:dc26-9.png?800|}}
+===== Conclusion=====
 Hope network analysis enthusiasts find this useful.   The docker image  bundles a [[https://trisul.org|Free License of Trisul]]. PCAP dumps upto 3 days in time can be imported.