PcapsE-OS X

Features

• PcapsE-OS X is a wrapper of tcpreplay directly integrated on Mac OS X Mavericks 10.9.3 for the execution of caps files that generate simulated malware traffic to test IDS Mac OS X based or redirecting simulated malware traffic on the interface of the IDS to other devices that perform correlation of events to test effectiveness. You need install libnet and tcpreplay. Libnet: sudo port install libnet11 @1.1.6_2 and install tcpreplay-4.0.4.tar.gz and MonoFramework-MRE-2.10.11.macos10.xamarin.x86 that empowering Common Language Runtime on Mac OS X. PcapsE-OS X must be installed on the same platform that is hosting the IDS and all the traffic generated by PcapsE-OS X should be directed to the IDS interface in order to test the effectiveness or the effectiveness of devices that performing correlation of events redirecting simulated malware traffic on the interface of the IDS to these devices. In Figure 2 and 3 show the use of PcapsE-OS X and the next step of packet capture with Wireshark. In Figure 3 in order to illustrate the use of PcapsE-OS X is the comparison between the malware traffic sniffed of the caps executed with the corresponding malware traffic contents in file .cap that i have renamed in file .pcap because Wireshark read only files with extension .pcap. Note: For run PcapsE-OS X you need to be root. The update source option 39 is Malware-Traffic-Analysis. Install Rename.dmg contents in PcapsE-OS X v.1.0.tgz and use the program Rename to change the extension of files .pcap in files .cap and read instructions for configuration of Mac OS X Syslogd.

Follow PcapsE-OS X

PcapsE-OS X Web Site