Full Packet Capture Infrastructure Based on Docker Containers

Full packet capture systems have become an important piece of any organization's security infrastructure; having an exact picture of events that happened in the past is fundamental for authorized stakeholders who need to identify the cause-effect of relevant incidents. Particularly in IT security, every piece of information that flows through the network is considered a potential risk to the organization. There is no silver bullet to detect or prevent 100% of threats. Attackers are improving their methodologies to circumvent protective technologies with sophisticated evasion techniques. In most cases when an incident has already occurred, a Full Packet Capture (FPC) not only provides the history of the events in question, but might also provide interesting correlations with other phases of the incident that aren't easy to identify at first glance. One of the biggest challenges in today's Organizations is the cost of having an effective Centralized Full Packet Capture Infrastructure (CFPCI). Commercial solutions are quite expensive and can be hard to implement, here is where a good combination of Open Source Technologies such as Moloch, Puppet and Docker can help to minimize cost and effectively fill the gap.