Hello all,
I am working on a project where it includes a network of IoT connected to a server (Raspberry Pi 3+) . the raspberry pi has wireshark installed to analyze network traffic and save the sessions to pcap files. I want to detect some know attacks on the traffic using machine learning. can you help me with some resources on that to help me get started?
Wireshark uses pcap to capture packets --from Wireshark. Unix-like systems implement pcap in the libpcap library; Windows uses a port of libpcap known as WinPcap again from wiki. WinPcap internals has internal details of winpcap, the windows port of libpcap, long story short it includes a device driver called NPF which is a protocol driver which connects with NIC driver at its lower end .
For linux the situation is logically similar, the packet at NIC driver might be put on a queue and then passed on to each registered capture-r and the IP stack by the network driver.
Reference: https://www.winpcap.org/docs/docs_41b5/html/group__NPF.html
Hello Ahmad,
Please find this paper which can be helpful for you:
https://link.springer.com/chapter/10.1007%2F978-3-319-73951-9_5
- Badges
- Science topic