Values can be true or any other value for false. This input specifies whether to run the parsing and enrichment playbook.

This input specifies the file entry ID for the PCAP file if the user provided the file in the incident. This playbook does not use any integrations. This playbook uses the following sub-playbooks, integrations, and scripts. In order to demonstrate the entire flow make sure that at least on of the following playbook inputs is configured in order for search results to exist. The playbooks is meant to be a demonstration of all the PCAP analysis capabilities however it is more likely to use each of the subplaybooks seperatly.

Carve (extract) files found in the http, smb and other protocols and perform enrichment and detonation.

Parse and enrich detected indicators such as IP addresses, URLs, email addresses and domains found by the search.

Search for specific values in a PCAP file.

This playbook leverages all of the PCAP miner and PCAP file extractor sub playbook capabilities, including: It is very useful to people learning Wireshark and want to perform some analysis or test out some features on good pcap files which has more variants of realistic network traffic, furthermore, the choices are vast and interesting (since you did not create it yourself, there are some element of surprise).This Playbook is part of the PCAP Analysis Pack. You are right, a compiled list of sample pcap files consolidated by people in the community and listed together in the Wireshark Wiki. What I am going to share is actually a compiled list of sample pcap files. The tool itself has many features, which I am not going to do a step-by-step guide today. One of the best tool used in the industry for performing packet capturing would be no doubt, Wireshark. Interesting uh? Image Courtesy: Wikipedia/Wireshark Some simple research will tell you that it is a file that captures network traffic.

Before I was given the task, I don’t even know anything about pcap file. I was once tasked to perform some investigation on a packet capture (pcap) file to retrieve some information.

Sample pcap files for analysis