In this clip,
we'll discuss the advantages of capturing packets to a PCAP
file and replaying the traffic to test rules.
We'll start with the basics.
What is PCAP?
PCAP stands for packet capture.
Traffic‑sniffing programs can use these files to store the packets they capture
from the network. When activated on Suricata, the PCAP log files contain all
the packets Suricata processes while it's running.
The advantage of capturing these packets in a log is that we can
later use these files for additional traffic analysis using other
programs. Or, we can replay the traffic using Suricata to evaluate
the effects of new rule sets.
Let's see how that works with Suricata. When you activate the PCAP
log feature in the Suricata configuration file, Suricata begins to
capture the traffic as it normally would,
but it also stores each packet it captures in a log.pcap file in
addition to processing it against the configured rule sets.
If we want to use this file later,
we can enter our Suricata command, but then add the r switch and specify
the local PCAP file to replay it against a new rule set.
This causes Suricata to process that previously captured packets again
against a new rule set configured on the server.
This generates a new set of alerts or drops,
allowing us to evaluate the effects of our rule set without
repeatedly creating the same scenario.
This is valuable for testing in a lab,
but also for evaluating previous captures of traffic after an incident
occurs. If we had a PCAP file capturing an incident,
we could use that file to test different rule sets against
identical conditions repeatedly while we reconfigure our
rules to provide better detection.