Potentially be misused do not use it on any network of which youįlow, in positive psychology, is a state in which a person As with any network monitoring tool, Joy could The benefit of the broader community through improved defensive Networks being monitored, and in the case of vulnerabilities, for Researchers,Īdministrators, penetration testers, and security operations teamsĬan put this information to good use, for the protection of the Threats and other unauthorized or unwanted behavior. The monitoring of (small scale) networks to detect vulnerabilities,

Joy is intended for use in security research, forensics, and for

Originate or terminate on the host on which pcap is running. The name of the process associated with the flow, for flows HTTP header elements and the first eight bytes of the HTTP Other non-encrypted TLS data, such as the list of offeredĬiphersuites, the selected ciphersuite, the length of theĬlientKeyExchange field, and the server certificate strings, The sequence of lengths and arrival times of TLS records, The empirical probability distribution of the bytes within theĭata portion of a flow, and the entropy derived from that value, Up to some configurable number of packets. The sequence of lengths and arrival times of IP packets, Information about events that occur within a network flow, Joy can be configured to obtain intraflow data, that is, data and They are reasonably small, and they respond well to compression. While the JSON output files are somewhat verbose, JSON is used in order to make the output easily consumable by dataĪnalysis tools. Joy can be used to explore data at scale, especially ItĪlso contains analysis tools that can be applied to these dataįiles. Netflow, and then representing these data features in JSON. Joy is a BSD-licensed libpcap-based software package for extractingĭata features from live network traffic or packet capture (pcap)įiles, using a flow-oriented model similar to that of IPFIX or A package for capturing and analyzing networkįlow data and intraflow data, for network research,Īddendum: For our most recent network fingerprinting tools and data, please see Mercury.

Cisco packet capture tool