n0mad1k/bigbrother
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Full PCAP on all tiers — no headers-only, no tiered retention. 128GB+ with zstd-19 handles it.

Browse Source
This commit is contained in:
n0mad1k
2026-03-17 12:09:22 -04:00
parent 4a22eb566f
commit 0a40103fd5
2 changed files with 10 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
OPERATIONAL_WORKFLOW.md
+6 -8
View File
@@ -23,15 +23,13 @@ After 72 hours of passive collection on this network, here is exactly what each
```
storage/pcaps/
├── headers_2026-03-18_00-00.pcap.zst.enc (4.1MB — snap=96 headers-only)
├── headers_2026-03-18_01-00.pcap.zst.enc (3.8MB)
├── headers_2026-03-18_02-00.pcap.zst.enc (0.9MB — overnight, minimal traffic)
├── ... (24 hourly files)
├── cred_ring_2026-03-18.pcap.zst.enc (18MB — full payload, auth ports only)
└── full_capture_operator_session_1.pcap.zst.enc (operator-triggered)
├── full_2026-03-18_00-00.pcap.zst.enc (47MB — full payload, zstd -19 compressed)
├── full_2026-03-18_01-00.pcap.zst.enc (52MB)
├── full_2026-03-18_02-00.pcap.zst.enc (8MB — overnight, minimal traffic)
├── ... (24 hourly files)
```
**Size**: ~80MB/day compressed for headers-only (from ~2.1GB raw). Credential ring (full-payload capture on ports 21, 25, 80, 88, 110, 143, 389, 445, 1433, 3306, 3389, 5432, 9100) adds ~18MB/day. At this rate, 128GB SD holds 3+ months of headers and credential traffic.
**Size**: This dental office generates ~15-25Mbps average traffic during business hours, near-zero overnight. That's roughly 8-12GB raw per day. With zstd -19 compression (10-15x on network PCAPs): **~600MB-1.2GB/day compressed**. On a 128GB SD card, that's **100-200 days** of full capture. On a 256GB card, over a year. Full payloads mean every print job, every SQL query, every file transfer, every cleartext credential is in the PCAP for offline analysis.
**Protocol breakdown for this network (24h, by packet count)**:
@@ -49,7 +47,7 @@ ARP 2% Normal L2 resolution
Other 2% NTP, ICMP, LLMNR, NetBIOS
```
**What you can do with it**: Open the credential ring PCAPs on your workstation in Wireshark to manually inspect any authentication you want to re-examine. The headers-only PCAPs give you flow-level forensics (who connected to whom, when, how much data) without the storage cost of full payload.
**What you can do with it**: Pull the compressed PCAPs to your workstation (`zstd -d` to decompress), open in Wireshark for full protocol analysis. Every packet payload is there — you can reconstruct files, replay sessions, extract credentials you missed, carve attachments. Full PCAP is the ground truth that backs up every other module's findings.
---