Forensics
What your PCAP can tell your ISP (and what it can't)
Most ISPs will ask for a PCAP when you request a null-route or BGP blackhole. Here's how to read what Flowtriq...
10 min read →Blog
Attack postmortems.
Engineering deep-dives.
Practical guides from engineers who've been DDoS'd and learned from it.
All
Post-Mortem
Attack Analysis
Original Research
Engineering
Forensics
Integrations
Mitigations
Fundamentals
Tools
Comparisons
Forensics
How to read a DDoS PCAP file: step by step with Wireshark
Protocol hierarchy, conversations, I/O graphs, display filters for every attack type, tshark automation, and extracting evidence for your ISP.
Newsletter
Attack analysis in your inbox
One email a month. Real attack postmortems, detection techniques, and engineering insights. No marketing fluff.
No spam. Unsubscribe any time.