Wednesday, August 17, 2011

Packet Analysis in the Cloud

So, aside from resisting anything with 'cloud' in the title, I've avoided "cloud" based packet analysis tools because they didn't make sense to me.  Packet capture an analysis is very much a local thing.  Usually, you need to be attached to a device to capture packets.  Even with technologies like RSPAN and ERSPAN, packets always end up on a machine, are analyzed, and then forgotten.

Its the forgotten part that is the problem.  For a long time I've wanted to created a shared library for reference packet captures- a view of what things should look like when they're working.  It appears someone not only had that idea, but the ability to create a product around it: CloudShark.  Software or hardware appliance that stores packet captures for sharing and annotation.



There is also pcapr which seems to provide many of the same features, and even more, though I haven't done a full comparison of the two.

No comments:

Post a Comment