So, aside from resisting anything with 'cloud' in the title, I've avoided "cloud" based packet analysis tools because they didn't make sense to me. Packet capture an analysis is very much a local thing. Usually, you need to be attached to a device to capture packets. Even with technologies like RSPAN and ERSPAN, packets always end up on a machine, are analyzed, and then forgotten.
Its the forgotten part that is the problem. For a long time I've wanted to created a shared library for reference packet captures- a view of what things should look like when they're working. It appears someone not only had that idea, but the ability to create a product around it: CloudShark. Software or hardware appliance that stores packet captures for sharing and annotation.
There is also pcapr which seems to provide many of the same features, and even more, though I haven't done a full comparison of the two.
No comments:
Post a Comment