Important Notice: Our web hosting provider recently started charging us for additional visits, which was unexpected. In response, we're seeking donations. Depending on the situation, we may explore different monetization options for our Community and Expert Contributors. It's crucial to provide more returns for their expertise and offer more Expert Validated Answers or AI Validated Answers. Learn more about our hosting issue here.

Can I use BotHunter to analyze a large corpus of packet traces?

April 26, 2017analyze bothunter Corpus large packet traces

0

Posted

Can I use BotHunter to analyze a large corpus of packet traces?

1 Answer

0

Posted

Yes. Ensure that when you install BotHunter on your system, that you have installed the proper network configuration parameters that describe the network on which you captured your tcptrace files (i.e., tcpdump files). Also, ensure that your captured packet trace files were captured using full snaplen (e.g., tcpdump -s 0). You may use the runsnort.csh script in the BotHunter directory to produce a dialog event file from your packet trace file. Next, configure a BATCH mode configuration directory of BotHunter, and then run your dialog event file through BotHunter.