I woke up this morning and was very excited to see a post on a blog a frequent, Packet Life. It looks like the folks at QA Cafe have just launched a new project called CloudShark. I’ve been playing with CloudShark all morning and I’m very impressed. A colleague of mine wrote something similar to this a while back with intentions of publishing it but never did, so I’m glad someone set forth on a similar project. I plan on using CloudShark as a component of this blog, so from now on any packet captures I post will have a “view online” link that should display the captures directly in your browser.
The best resource for more information on CloudShark seems to be their FAQ:
What is CloudShark?
CloudShark is a web site that displays network capture files right in your browser instead of running desktop tools such as Wireshark. You upload, link, or email your capture files and we’ll display them.
Why CloudShark?
We work with network capture files on a daily basis. After trying to view capture files on mobile devices without Wireshark support, we realized it was time to move packets to the cloud. The CloudShark idea was born. CloudShark was created to make viewing capture files easy from any device ranging from desktops to smart phones. After creating our own solution, we decided to make it available to everyone as CloudShark.org.
How does it work?
* Generate your capture file or use an existing capture file
* Email it, upload it, or link it
* CloudShark does the rest by providing a decode session
* If you email CloudShark with an attached capture file, we’ll email you back with a link to your decode session
* Send your capture files as an attachment to cap@cloudshark.org
* If you are in the browser already, we’ll drop you into your decode sessionAre my capture files publicly accessible?
While the URLs to your decode session are not publicly shared, we make no claims that you data is not viewable by other CloudShark users. For now, if you want to protect sensitive data in your capture files, don’t use CloudShark.
Is there any limit to the size of the capture file I can upload?
Capture files are currently limited to 512 Kbytes. Larger files will be rejected.
Can I delete my decode session after I am done with it?
Not directly. Eventually it will be deleted when the disk space is recycled.
How long is my decode session available?
CloudShark is not a file storage site. We’ll try to keep your files around, but obviously there is a limit to the amount of files we can keep around. If the link to your decode session is no longer working, you may need to upload the capture file again. In the future we may provide persistent storage, but for now you should store your capture files somewhere else.
What capture formats are supported?
CloudShark uses tshark to do the actual decoding. tshark supports several capture files from other tools besides Wireshark. See http://wiki.wireshark.org/FileFormatReference.
I have a capture file hosted on my web site. Is there an easy way I can link a CloudShark decode session to this capture file?
Yes. You can create a CloudShark link that includes a URL to your capture file. Here is an example:
http://www.cloudshark.org/view?url=http://packetlife.net/captures/TCP_SACK.cap
Who are you?
CloudShark was created by QA Cafe. We are the creators of CDRouter, the leading CPE testing solution. We spend a lot of time working with capture files. You can visit us at qacafe.com.
Is this project connected to Wireshark.org?
No, not directly. We do use Wireshark, tshark actually, on our back end.
How can I contribute?
If you have any ideas, you can contact us at info@cloudshark.org.
Kudos to the folks at QA Cafe for putting this together! You can visit CloudShark at http://www.cloudshark.com and you can follow Cloudshark developments on Twitter at @Cloudshark.