Question Will Kaspersky's network monitor catch suspicious activity in time?

Kaspersky
45 Replies 5,616 Views
Help answer the author's question with clear explanations and useful steps.
The only real way to detect network attacks is through SSL or TLS interception. Which means installing a vendors cert which opens up various problems but some benifits.

Wireshark in 2025 is basically dead for everything except education, any serious malware on any platform is going to use encrypted communication channels for C2 and data transmission.

Saying that it's worth learning Wireshark just for kicks, learning should be commended at any level.
 
Zero Knowledge said:
The only real way to detect network attacks is through SSL or TLS interception. Which means installing a vendors cert which opens up various problems but some benifits.

Wireshark in 2025 is basically dead for everything except education, any serious malware on any platform is going to use encrypted communication channels for C2 and data transmission.

Saying that it's worth learning Wireshark just for kicks, learning should be commended at any level.
Click to expand...
Wireshark's role has evolved significantly. While it's no longer the go-to tool for detecting sophisticated malware, it's far from "dead." The core challenge is that a basic Wireshark capture of encrypted traffic will only show you a jumble of unrecognizable data, which severely limits its use for direct malware analysis. However, its value in other areas is immense. For anyone learning networking, it's an indispensable educational tool for understanding how protocols fundamentally work. Beyond that, professionals continue to rely on it for troubleshooting network issues like bottlenecks or latency, and for protocol analysis of unencrypted or proprietary traffic. In a modern security environment, Wireshark is also a powerful forensic tool for analyzing decrypted traffic after it has passed through an SSL inspection appliance. It's also increasingly used for Encrypted Traffic Analysis (ETA), where security tools use AI and machine learning to analyze the metadata of encrypted traffic, such as packet size and timing, to spot malicious patterns, and Wireshark is then used to capture that traffic for a closer forensic look at those patterns.
 

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top