Modules

Analyze

The core module. This module constructs the site and its context. PCAP- and PCAPNG-formatted capture files are ingested. Information is extracted and parsed from the protocol management and control frames. The data frames are ignored.

The observational surface is constructed and enriched. Data is mined, sorted, filtered, enumerated, classified, scored for reliability and prepared for basic inference. All inference information receives confidence scoring.

We offer basic anonymization of MAC addresses when selected on the job form. Anonymization is performed on completion of the analysis and in a manner that does not disrupt the validity of the data. Advanced anonymization will be avialable in the Anonymization module.

The analysis and emerging site fingerprint is output to CBS Explorer and to one or more selected file formats. Files are optionally populated with dictionary-type data structures.

For detailed information on the data types and formats we use to shape the analysis data, see Data Types. For information on the descriptive tables we generate, see Data Tables.

For information about how we use the wireless capture data that is uploaded to the framework, see Privacy Notice.

Input formats

• Wireshark: PCAP, PCAPNG

Output formats

• Plaintext · HTML · CSV · JSON

Data types

• Python dict (dictionary)
• ANSI C struct (structure)

Persistence and Mobility

Analysis of mobile behavior and persistent devices.

Anonymize

Advanced anonymization of analysis fields. The anonymized replacement values are provided in a CSV copy of the observation summary. Anonymization across capture files submitted in batches.