Kaspersky Anti Targeted Attack Platform

Searching network packets

You can find and view the traffic related to the selected network packets. If necessary, you can download dumps of the found traffic.

To find traffic related to the selected network packets:

1. Select the Network map section in the application web interface window.
2. Go to the Network sessions tab.
3. Click Search in packets.

   This opens the window with network packet search settings.

4. Do the following:
   • In the Period of traffic to download field, set the bounds within which you want to search network packets.
   • If necessary, enable filtering under Filtering using BPF and enter an expression for filtering using the BPF (Berkley Packet Filter) technology by address parameters in network packets of the selected network sessions. The BPF filtering expression is written in the libpcap format. For more details about the syntax, please refer to the pcap-filter manual page.

     Example of a filter expression:
     tcp port 102 or tcp port 502

   • If necessary, enable filtering in the Filtering using regular expressions section and enter an expression for filtering based on payload data in network packets.

     Example of a filtering expression:
     ^test.+xABxCD

   • If necessary, enable filtering under Filtering by monitoring points and specify the monitoring points from which you want to get traffic.
   • If necessary, enable filtering under Filtering by address spaces and specify the address spaces to which the addresses in network packets belong.
5. Click Search.

   The table displays data that match the filtering criteria.

6. If you want to download the dumps of the found network packets, click Download.

Raw network traffic dumps are downloaded in PCAP format.