Is there any way to automatically analyse if the captured data is "business as usual" so we can skip analyzing such data or if it is "unusual" and it requires more detailed analysis? Is such a filter available based on previously captured large sets of packet data, rules and/or configuration?
Wireshark does provide some automated help in this area via its "Analyze -> Expert Information" feature, but ultimately it's up to the user to determine what is or isn't "business as usual"or not. There are other tools out there that can help analyze capture files though, so you might want to have a look at some of those listed at https://wiki.wireshark.org/Tools.
Asked: 2019-02-13 14:43:01 +0000
Seen: 203 times
Last updated: Feb 13 '19
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
