OpenPacket Blog

Yes, we're here. No, we haven't left. Yes, we want your pcaps.

2010-05-25T15:48:00.000-04:00

We here at OpenPacket.org HQ, deep in the mountains, received an email yesterday asking if we are still alive.

Answering in a truly Steve Jobs way:
Yes.

Of course, we're still here, and we aren't going away. There is a lot of background work going on, as far as updates to the site, and things we are waiting on Ruby for, however, we still need the pcaps you submit.

Received an email from a contributor asking if they could upload their pcaps, apparently a bunch of them, to which we responded, "Yes, of course!" We like pcaps, we'd like more of them, and our databases are waiting for them from you.

Upload!

Forward Planning and Thanks

2009-03-09T13:36:00.007-04:00

I would like to begin by thanking Richard for his time and dedication in getting this project off of the ground.

There have been a number of changes in recent months, including the migration of the site onto new hardware to increase stability. There are a number of significant changes that are rapidly approaching that include some partnerships and significant site enhancements. This being said, please stay tuned for these upcoming developments and let us know how we are doing by participating in the forums and capture uploads.

I would also like to extend a warm welcome to our latest moderator; Joel Esler.

Cheers,
JJC

Bejtlich No Longer Operating Project

2009-01-25T10:17:00.001-05:00

Officially effective today, I am no longer operating the OpenPacket.org project. JJ Cummings is now in leading the project. I still own the openpacket.org domain name and OpenPacket blog, but JJ will be able to post to the blog once he asks to do so. Thank you.

OpenPacket.org 1.0 Is Live

2008-04-04T13:50:00.002-04:00

Nearly three years after the initial post describing the idea , I am happy to report that OpenPacket.org 1.0 is ready for public use, free of charge.

The mission of OpenPacket.org is to provide quality network traffic traces to researchers, analysts, and other members of the digital security community. One of the most difficult problems facing researchers, analysts, and others is understanding traffic carried by networks. At present there is no central repository of traces from which a student of network traffic could draw samples. OpenPacket.org will provide one possible solution to this problem.

Analysts looking for network traffic of a particular type can visit OpenPacket.org, query the OpenPacket.org capture repo for matching traces, and download those packets in their original format (e.g., Libpcap, etc.). The analyst will be able to process and analyze that traffic using tools of their choice, like Tcpdump, Snort, Ethereal, and so on.

Analysts who collect their own traffic will be able to submit it to the OpenPacket.org database after they register.

Anonymous users can download any trace that's published. Only registered users can upload. This system provides a level of accountability for trace uploads.

Our moderators will review the trace to ensure it does not contain any sensitive information that should not be posted publicly. Besides appearing on the site, once a trace has been published you can receive notice of it via this published trace RSS feed.

If you have any doubt regarding the publication of a trace, do not try to submit it. When moderators are unsure of the nature of a trace, we will reject it. OpenPacket.org is not a vehicle for publishing enterprise data as contained in network traffic.

I would like to thank all the people who submitted suggestions and did feature testing via the openpacket-devel mailing list. If you have issues regarding usage of the site, consider subscribing to the openpacket-users mailing list or post to the OpenPacket.org Forums.

As time permits I will probably post more on how to use OpenPacket.org strictly on the OpenPacket Blog. I will minimize cross-posting to TaoSecurity Blog and OpenPacket Blog.

I save my final thanks for Sharri Parsell, our Web developer, and JJ Cummings for hosting OpenPacket.org. Without your work we would not have a site!

OpenPacket.org Almost Ready to Launch

2008-03-29T21:47:00.001-04:00

I think we're almost ready to go live. I asked Sharri to take a look at the ability to remove traces once published, and a few other minor items. Assuming she can make those changes, I'd like to post word of OpenPacket.org on the TaoSecurity Blog on Wednesday 2 April.

If you have any final testing you'd like to do, please do so before we go "live."

OpenPacket.org is available at http://www.openpacket.org.

OpenPacket.org RC2

2008-02-02T21:30:00.000-05:00

Thanks to yet more excellent, all-volunteer work by our developer Sharri Parsell, I am happy to notify you RC2 of OpenPacket.org is now available at

http://beta.openpacket.org:8080/

Thank you to JJC of www.redsphereglobal.com for continuing to provide hosting. JJC will host the site until it appears that we are outgrowing his generosity. If you would like to sponsor us, please contact me (taosecurity at gmail dot com).

Please take another look at the site and report feedback to the openpacket-devel@lists.sourceforge.net mailing list.

This site is considered RC2 quality. We plan to announce RELEASE on 20 February to coincide with the first day of Black Hat DC Briefings.

If you are interested in assessing the security of the site, please contact me directly. We can coordinate with Sharri and JJC to ensure your discoveries do not catch us by surprise. We appreciate those of you who did some XSS testing -- please try again and let us know what you find.

OpenPacket.org RC1

2008-01-08T06:15:00.000-05:00

Thanks to even more excellent, all-volunteer work of our developer Sharri Parsell, I am happy to notify you RC1 of OpenPacket.org is now available at

http://beta.openpacket.org:8080/

Thank you to JJC of www.redsphereglobal.com for continuing to provide free temporary hosting. We are working on a more permanent solution, but if you have ideas now please let me know.

Please take a look and report feedback to the openpacket-devel@lists.sourceforge.net mailing list.

This site is considered RC1 quality. We plan to announce RC2 on 18 January, followed by a public RELEASE on 1 February.

If you are interested in assessing the security of the site, please contact me directly. We can coordinate with Sharri and JJC to ensure your discoveries do not catch us by surprise. We appreciate those of you who did some XSS testing -- please try again and let us know what you find.

New Beta Site Live

2007-10-13T11:45:00.000-04:00

Thanks to more excellent, all-volunteer work of our developer Sharri Parsell, I am happy to notify you that a beta demo of OpenPacket.org is now available at

http://beta.openpacket.org:8080/

Thank you also to JJC of www.redsphereglobal.com for providing free temporary hosting. We are working on a more permanent solution, but if you have ideas now please let me know.

Please take a look and report feedback to the openpacket-devel@lists.sourceforge.net mailing list.

This site is considered "beta," and we are getting closer to public announcements of the site. If you are interested in assessing the security of the site, please contact me directly. We can coordinate with Sharri and JJC to ensure your discoveries do not catch us by surprise.

New Alpha Site Live

2007-09-28T20:57:00.000-04:00

Thanks to the excellent, all-volunteer work of our developer Sharri Parsell, I am happy to notify you that an alpha demo of OpenPacket.org is now available at Sharri's temporary site:

http://openpacket.spaceegg.net/

Please take a look and report feedback to the openpacket-devel@lists.sourceforge.net mailing list.

This site is considered an "alpha" because we are still working on functionality, administration, appearance, and so on. If you are interested in assessing the security of the site, please contact me directly. We can coordinate with Sharri to ensure your discoveries do not catch us by surprise.

OpenPacket.org Developments

2007-07-03T20:59:00.000-04:00

I am happy to report that work on OpenPacket.org is back on track, thanks to a new volunteer Web application developer.

Several months ago Richard Fifarek put me in touch with his friend Sharri Parsell. She read the requirements document I wrote last year and discussed the project with me.

Today she showed me a pre-alpha version based on our discussions over the last few months. I was very impressed and we plan to have an alpha ready for review by openpacket-devel list members within the next two weeks. I've also contacted a few guys I trust who perform Web app assessments to review the site prior to general public availability.

If development stays on track we plan to have a beta available for the public prior to Black Hat at the end of this month.

Stay tuned to this mailing list and/or the OpenPacket.org Blog for more developments.

Thank you especially to Sharri for volunteering to do this work and getting us close to public availability!

Sincerely,

Richard

Alpha Demo Site Live

2006-09-25T08:57:00.000-04:00

[Removed by request] has reactivated the OpenPacket alpha demo server. It is available at:

openpacket.dyndns.org:8000

The site will be live:

Monday from 7am to 5pm
Tuesday from 7am to 5pm

All times are EST (I believe).

To gain moderator status, visit

openpacket.dyndns.org:8000/makememoderator

[Removed by request] says:

Things that have been done since last demo:

- Moderators can dis/approve and leave comments
- A log is written each time a dis/approval is made
- Remoderation feature: moderators can re-approve a disapproved file or perm delete it (log is written)
- Number of downloads is now shown for each file
- A marker has been added if the file is sanitized
- You can sort when browsing files
- Searching features have been added for comments
- Searching features have been added for parsed information of files
- Clicking a user brings a page with all the files that user uploaded
- Moderators can put "final comments" on a file. This comment will be highlighted
- Categories have been added

What needs to be done:
- Tagging
- Rating of files
- Rating of users
- Checksums
- Validate that the uploaded file is a pcap file
- Add the openpacket logo

Please give the demo a try and post your feedback to the openpacket-devel list.

Thank you [Removed by request], and thank you testers!

Another Round of Alpha Demo Testing Soon

2006-09-18T08:35:00.000-04:00

[Removed by request] is coding the suggestions made since the demo last month. He expects to be done within a week. When the demo site is available again, I will post a notice here and on the openpacket-devel mailing list. Thank you.

OpenPacket Alpha Demo Available

2006-08-04T16:32:00.000-04:00

[Removed by request] has made an alpha demo of OpenPacket.org available at http://roach4.no-ip.org:8000/ for the following limited times:

Friday: 4pm to 11pm Eastern
Monday: 1pm to 5pm Eastern

If you have comments on the site, please join the openpacket-devel mailing list and post them to openpacket-devel [at] lists [dot] sourceforge.net. You can see the archives here.

Remember this is a very rough first cut, so we are open to suggestions, feature requests, and help.

Draft Proposal Available

2006-07-21T16:36:00.000-04:00

I just posted the first draft of a document describing OpenPacket.org.

openpacket_req_doc_draft_21jul06.pdf

Please take a look and provide comments and suggestions. Those of you who want to help might want to announce yourselves on the openpacket-devel list to facilitate collaboration.

I did not assign any timelines because I am not sure of the level of effort required to make this a reality. At the very least this document is a starting point.

Thank you!

OpenPacket.org Already Under Construction?

2006-07-19T14:17:00.000-04:00

I received an email today from a long-time TaoSecurity Blog reader saying he had started assembling a site for OpenPacket.org. This is great news. I am going to work on a requirements doc this week and try to get it to this benefactor by week's end. I'll let him reveal his own name since I am not sure if he wants to publicize his involvement yet.

Please Post Functionality Requests to Mailing List

2006-07-17T12:28:00.000-04:00

Wow, I am already getting offers of help from two people. Thank you!

Please post any ideas you have regarding desired functionality to the openpacket-devel@lists.sourceforge.net mailing list.

Mailing Lists Created

2006-07-17T12:20:00.000-04:00

I just created two mailing lists:

openpacket-users

openpacket-devel

Since there are no users yet, devel is the best place to discuss how to build OpenPacket.org.

Both are hosted by SourceForge and require joining prior to posting.

OpenPacket.org Update

2006-07-17T10:18:00.000-04:00

It's been a very long time since I've said anything about OpenPacket.org at my TaoSecurity Blog. Although I am no closer to launching OpenPacket.org, I thought I would explain what's been happening. In short, I announced the project two months after starting my own company, TaoSecurity. Since then I have been exceedingly busy doing the business and technical work of running an independent consultancy, as well as being a real person in the non-security world.

I would still like to get OpenPacket.org going, but at the moment I have had no concrete offers of help with creating the site. Around the beginning of the project there was a possibility of corporate development and hosting support, but that fell through due to concerns over ownership. I became concerned the project would end up the intellectual property of a big company when the potential partner announced acquisition plans.

Several people have promised to contribute traces, but actually building a Web site with the necessary infrastructure and back end is still a problem I am being forced to solve. That would be ok if I had any experience in Web development, but I don't. Therefore, OpenPacket.org will not launch until I figure out how to build it. I have considered hiring a developer, but I am not sure if I could raise enough money to pay for the project. Ongoing maintenance might also be an issue.

If you have any thoughts on this matter, please feel free to post them below. Thank you.

OpenPacket Blog Launched

2005-09-10T20:14:00.000-04:00

Welcome to the pre-alpha version of OpenPacket.org. We will use this site to collect packet traces in Libpcap format prior to the formal launch of OpenPacket.org. Keep your eye on this site for future developments.