Digital Forensics and Incident Response

Xplico and CapAnalysis

As powerful a tool as Wireshark is, there may come a time when conducting a detailed examination of a packet capture, especially a larger packet capture, may not fit the incident. Furthermore, if an analyst wishes to isolate specific traffic such as HTTP or DNS traffic, there are tools that can be utilized for that purpose. Two such tools are Xplico and CapAnalysis. Both of these tools can be run on Linux operating systems and provide a platform for incident response analysts to gain an overall sense of what traffic is contained within a packet capture.