PFQ

PFQ v6.2 소개 PFQ는 Linux 운영 체제를 위해 설계된 기능적 프레임워크로, 효율적인 패킷 캡처/전송10G, 40G 이상, 커널 내 기능적 처리, 커널 우회 및 소켓/엔드포인트 그룹 간 패킷 스티어링을 위해 구축되었습니다. 멀티코어 아키텍처와 여러 하드웨어 큐를 갖춘 네트워크 장치에 대해 고도로 최적화되어 있습니다. 모든 NIC와 호환되며, 소스 코드에서 가속화된 네트워크 장치 드라이버를 생성하는 스크립트를 제공합니다. PFQ는 고성능 네트워크 애플리케이션 개발을 가능하게 하며, 레거시 애플리케이션을 가속화하고...

fastnetmon

Community Edition FastNetMon - A high-performance DDoS detector/sensor built on top of multiple packet capture engines: NetFlow, IPFIX, sFlow, AFPACKET port mirror. What do we do? We detect hosts in the deployed network sending or receiving large volumes of traffic, packets/bytes/flows per second...

Wireshark

Wireshark 악성코드 분석 설명 이 실습에서는 Log4j 취약점을 악용한 알려진 악성 패킷 캡처를 분석했습니다. 패킷 캡처 분석 시 사용하는 동일한 플레이북으로 조사를 시작했습니다. 즉, 통계를 확인하고 엔드포인트 간 통신량을 살펴보는 것입니다. 엄청난 수의 IP 주소를 발견하고 이를 지도에 표시하기 위해 Max Mind의 GEOIP 데이터베이스를 설치 및 구성하여 IP 주소를 국가와 도시로 변환했습니다. 이 많은 IP 주소는 Log4j 취약점이나 기타 악성 스캐닝을 위한 봇넷의 잠재적 공격을 의미합니다. 캡처된 트래픽이...

NetScope

NetScope 오프라인 우선 Windows 네트워크 조사 및 대응 플랫폼. NetScope는 보안 분석가, 침해 대응 담당자, CTF 플레이어를 위한 데스크톱 애플리케이션입니다. 패킷 캡처.pcap / .pcapng 또는 라이브 인터페이스를 입력받아 완전한 증거 기반 조사 결과 — 판정, 공격 스토리, 침해 지표, 추출된 전리품, 원클릭 대응 작업 — 를 클라우드 서비스나 유료 API 없이 전적으로 사용자의 머신에서 생성합니다. NetScope를 선택하는 이유 Wireshark, Suricata 및 몇 가지 스크립트로 대부분...

Sapito

Sapito Autoren: Sebastian Garcia [email protected], @eldracote, Veronica Valeros [email protected], @verovaleros Über Sapito Sapito ist ein Multicast-DNS-Sniffer mDNS und -Interpretierer, geschrieben in Python. Sapito schnüffelt Pakete aus einer Pcap-Datei oder einer Schnittstelle und...

SUSE CVE-2026-71402

An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. nicaptureinspectudpheader in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option walker in the DHCPv4 client wickedd-dhcp4 rea...

EUVD-2026-67080

An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. nicaptureinspectudpheader in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option walker in the DHCPv4 client wickedd-dhcp4 rea...

Astra Linux – Vulnerability in libpcap

The sf-pcapng.c file in libpcap before version 1.9.1 does not properly validate the PHB header length before allocating memory...

CVE-2026-76918

A flaw was found in Wireshark. A local attacker could exploit a vulnerability in the SSH Secure Shell protocol dissector, which is responsible for analyzing SSH network traffic. This flaw, triggered by user interaction, could lead to a crash of the Wireshark application, resulting in a denial of...

CVE-2026-19695

A flaw was found in the Gammu DCT3 trace file parser in Wireshark. This issue occurs when malformed packets are decoded from a packet capture file, causing a stack-based buffer overflow, resulting in a denial of service. Mitigation To mitigate this vulnerability, do not open untrusted capture fil...

CVE-2026-19694

A flaw was found in the TTX Logger file parser in Wireshark. This issue occurs when malformed packets are decoded from a packet capture file, causing a heap-based buffer overflow, resulting in a denial of service. Mitigation To mitigate this vulnerability, do not open untrusted capture files...

SUSE-SU-2026:3299-1 Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues: - CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser bsc1268971. - CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write bsc1268406. -...

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues: CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser bsc1268971. CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check bsc1271051. CVE-2026-52720: invalid...

JLSEC-2026-765 Remote packet capture support is disabled by default in libpcap

Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcapfindalldevsex. One of the function arguments can be a filesystem path, which normally means a directory with...

CVE-2026-15173

A flaw was found in Wireshark. A remote attacker could exploit a vulnerability in the pcapng file parser, leading to a crash of the application. This denial of service DoS could prevent legitimate users from accessing the service, impacting its availability. Mitigation To mitigate this issue, use...

SUSE CVE-2026-52721

Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipelines, limiting real-world exposure. A local attacker could...

wireshark: Improperly Controlled Sequential Memory Allocation in Wireshark

A flaw was found in the USB HID dissector in Wireshark. This issue occurs when malformed packets are decoded from a pcap file or the network, causing an excessive consumption of memory, resulting in a denial of service...

CVE-2026-52721

Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipelines, limiting real-world exposure. A local attacker could...

CVE-2026-52721

Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipelines, limiting real-world exposure. A local attacker could...

PT-2026-49337

Name of the Vulnerable Software and Affected Versions GStreamer affected versions not specified Description Multiple out-of-bounds read issues exist in the pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during the parsing of IPv4 and TCP headers. A local...