ariel/pcap-reportgenerator
Watch
1
0
Fork
You've already forked pcap-reportgenerator
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
Page: Security Detections
Pages
Display Filters FAQ Home Installation Reports and Command Line Security Detections User Guide
1 Security Detections
Ariel Alejandro Arigossi edited this page 2026-10-14 02:52:13 +00:00
Table of contents

Security Detections

After loading a capture the analyzer runs a set of heuristic detections. Their results appear in the Security tab and in every report. Each finding has a severity, a description, the source and target, when it happened, the evidence, a recommendation, and a display filter that selects the evidence packets.

Security tab

Detections are heuristics. Treat a finding as a lead to verify, not as proof: an authorised vulnerability scanner also triggers "port scan".

What is detected

Finding Severity Triggered when
TCP port scan High one host sends SYNs to many different ports of another host (default 25+)
Network sweep Medium one host sends SYNs to the same port on many hosts (default 15+)
ICMP ping sweep Medium echo requests to many different addresses (default 15+)
SYN flood High many handshakes to one service never complete (default 200+, mostly failed)
ARP spoofing High one IP address is announced by more than one MAC address
Several DHCP servers High DHCP offers/ACKs come from more than one server
ICMP redirect Medium ICMP redirect messages are seen
Credentials in clear text High logins over FTP, Telnet, POP3, IMAP, SMTP AUTH PLAIN or HTTP Basic authentication
Unencrypted protocol in use Low established Telnet, FTP, TFTP, POP3, IMAP, rlogin or rsh sessions
DNS tunnelling High a client sends many queries with very long or random-looking labels under one domain
Many failed DNS lookups Medium a client receives many NXDOMAIN answers (DGA malware, misconfiguration)
Beaconing Medium repeated connections to the same Internet endpoint at a regular interval (low jitter)
Large upload Medium an internal host sends a lot of data to an external host (default 5 MB)
Outdated TLS Medium SSL 3.0 / TLS 1.0 / TLS 1.1 negotiated, or a weak cipher (RC4, 3DES, NULL, EXPORT)
Suspicious port Medium a connection to a port typical of backdoors or botnets (4444, 31337, 6667, ...)
Form data over HTTP Low a POST/PUT to an external server over plain HTTP

Captured passwords are masked (W*********!) unless masking is disabled in the settings or with --no-mask on the command line.

Tuning

Analysis → Detection Settings changes the thresholds (ports for a scan, hosts for a sweep, failed handshakes for a flood, query count and label length for DNS tunnelling, beaconing interval and jitter, upload size...). The capture is re-analysed immediately. Restore Defaults resets them.

Internal and external addresses

Private (RFC 1918), CGNAT, link-local, loopback and IPv6 ULA / link-local addresses count as internal; everything else as external. Beaconing and large-upload detections only consider traffic to external hosts.