The Packets Made Me Do It: Distributed Full Packet Capture with OpenFPC
Leon Ward demonstrates deploying OpenFPC, an open-source distributed full packet capture system that integrates seamless PCAP retrieval into SIEM workflows.
Summary
The Value of Full Packet Capture in Incident Forensics
While flow records and IDS alerts indicate anomalous events, full packet capture provides the definitive source of truth required for forensic root-cause analysis.
Introducing OpenFPC Architecture
Leon Ward presents OpenFPC, a modular, distributed open-source framework for recording, indexing, and retrieving high-speed network traffic.
Configuring Daemon Nodes and Ring Buffers
Ward details optimizing daemon nodes with daemonlogger, PF_RING, and storage retention policies on commodity Linux hardware.
Integrating On-Demand PCAP Extraction with Snorby and SIEMs
The author demonstrates triggering sub-second PCAP extracts directly from IDS alerts, streamlining analyst investigation workflows.
Related talks
DCGVR Village·38 min
Mastering advanced tcpdump command-line syntax, Berkeley Packet Filters (BPF), and real-time packet carving for network troubleshooting and threat analysis.
Blue Team Village·20 min
Bashar Shamma
Walks through full packet capture analysis, session reconstruction, and PCAP carving using Moloch in OpenSOC.
Village Presentations·17 min
Monzy Merza
Splunk chief security evangelist Monzy Merza explores automated security operations, integrating SIEM detection with rapid orchestration workflows.