Is such type of question acceptable here? Idk, I am looking for anything like requests from LAN through my computer's vpn to anything unusual like torrent clients, games sites/servers various video sites (except youtube). And so on. Maybe a hidden VPN traffic inside my vpn. Anything like remote desktops.
-
you should give it a try and ask a specific question if you have any doubt about what you think can be wrong in your log file.– alshabotiJun 22, 2020 at 11:21
-
Is it possible to find any backdoor/rootkit by using wireshark without knowing anything. How hard will it be for a person without knowledge?– user123456789Jun 22, 2020 at 11:24
-
Windows 8.1. LAN, VPN– user123456789Jun 22, 2020 at 11:25
-
Is it possible that automatic online analyzer exists?– user123456789Jun 22, 2020 at 11:25
-
2A question which would just provide logs or packet captures and ask for a generic analysis (i.e. anything suspicious there) would likely be closed as lacking focus.– Steffen UllrichJun 22, 2020 at 11:39
Add a comment
|
2 Answers
We are not a code/site/log/packet dump analysis site. As you can imagine, we'd be flooded with random stuff to wade through.
Depends on the question. In general, I would say:
- "Here's a traffic dump. Notice anything strange?" Will be closed as "needs focus".
- "Here's some relevant subset of trafic. I suspect X. Is that correct?" Probably OK question!
- "Here's some small subset of trafic that I don't understand. I expected X but got Y. What is going on here?" Probably OK as long as there is a security angle to it.
The key is that you need to focus on something specific, and not just a big dump of traffic. The goal is for questions here to be useful for more than just the person asking them. Since your traffic is unique to you nobody else will benefit from a general analysis.
If your goal is "to find any backdoor/rootkit by using wireshark without knowing anything" it is not specific enough to ask here, I'm afraid.