Large-scale data capturing, collection, and indexing

In a large infrastructure environment, capturing, extracting, and storing data becomes a bottleneck at times. In such cases, we can use Moloch, which is a free, open source, large-scale packet-capturing system that allows us to draw intelligence while effectively managing and storing the data:

Moloch packet capturing system

From the preceding screenshot, we can see various stats with respect to the source IP and destination. Expanding the first entry ( -> 172.217.7,4), we can see plenty of detailed information:

Expanding the first entry ( ->

We can ...

Get Hands-On Network Forensics now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.