Adding Argus Flow Capture to the Cuckoo Sandbox

[Carter Bullard]

Hey Dave,
Why do you filter out arp’s during the capture ???
I understand the filters to not capture Cuckoo’s internal traffic, but arp’s maybe a part of the malware.

Carter

On Jun 22, 2014, at 2:37 PM, David Edelman <dedelman at iname.com> wrote:

> The cuckoo sandbox already has the ability to use tcpdump to capture traffic between the sandbox and the network and Argus is very good about digesting pcap files but I thought that I would try to create a native Argus capability and for reasons that I can’t understand, it worked.
> 
> The attached document has the specifics.
> 
> Carter, please feel free to add this to the distribution but you probably need to look at, and modify  the boilerplate at the top of the Argus.py module
> 
> --Dave <<...>>
> 
> <Argus for Cuckoo Sandbox.txt>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20140623/1c8eccad/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6837 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20140623/1c8eccad/attachment.bin>