sb_finder

Find suspicous data in network streams

sb_finder is the analyzing part of the StalkerBuster. It is based on third-party libraries to scan .pcap files.

.pcap Libraries

For now, we are experimenting with different libs that allow scanning .pcap streams.

The candidates:

• libpcap
• pcapy
• scapy
• pyshark
• pycapfile

Currently evaluated: scapy