How it works

To capture and interpret network traffic, QEMU virtual machines are used on the server virtualization management platform Proxmox VE based on:

Windows 10 Pro 64bits with automatic updates enabled.
Windows 8.1 Pro 64bits with automatic updates enabled.
Windows 7 SP1 Pro 64bits with automatic updates enabled.

Traffic dumps are cleaned monthly and compared with the current rules to update hosts and firewall rules. Tools used to capture traffic:

qemu -net dump : capture
Wireshark : capture + logs
Sysmon : capture + logs
Proxifier : logs

Go to Usage page