# Sharing good sources of sample captures **URL:** \ **Category:** Tips and Tricks\ **Tags:** tips, pcaps, resources\ **Created:** [September 29, 2021, 7:29pm UTC](https://forum.suricata.io/t/sharing-good-sources-of-sample-captures/1766 "2021-09-29T19:29:24Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\ **Post date:** [September 29, 2021, 7:29pm UTC](https://forum.suricata.io/t/sharing-good-sources-of-sample-captures/1766/1 "2021-09-29T19:29:24Z")
Hello all! A useful resource for developers, rule writers and Suricata enthusiasts and users are sample capture files. Those can help us create new tests, improve existing protocols, practice threat hunting and malware analysis, creating training material and much more. [18. Public Data Sets — Suricata 7.0.0-dev documentation](https://suricata.readthedocs.io/en/latest/public-data-sets.html) has a list with good sources, but as the documentation isn’t as dynamic as a forum thread, I want to kickstart sharing a few more useful links, and hopefully, others out there will have more cool reliable pages to share. 🙂 **Please** only share trusted sources, let’s try to keep this community a safe space for others to find data sets! ---
**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\ **Post date:** [September 29, 2021, 7:30pm UTC](https://forum.suricata.io/t/sharing-good-sources-of-sample-captures/1766/2 "2021-09-29T19:30:40Z")
Our @jstrosch’s repo, updated often: > **[GitHub - jstrosch/malware-samples: Malware samples, analysis exercises and...](https://github.com/jstrosch/malware-samples)** > > Malware samples, analysis exercises and other interesting resources. - GitHub - jstrosch/malware-samples: Malware samples, analysis exercises and other interesting resources. ---
**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\ **Post date:** [September 29, 2021, 7:33pm UTC](https://forum.suricata.io/t/sharing-good-sources-of-sample-captures/1766/3 "2021-09-29T19:33:40Z")
Brad Duncan keeps [https://www.malware-traffic-analysis.net/](https://www.malware-traffic-analysis.net/) another great source for malware traffic pcaps and exercises, tutorials, and more. ---
**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\ **Post date:** [September 29, 2021, 7:34pm UTC](https://forum.suricata.io/t/sharing-good-sources-of-sample-captures/1766/4 "2021-09-29T19:34:18Z")
For miscellaneous traffic, one option is > **[GitHub - cisco-system-traffic-generator/trex-profiles: traffic profiles...](https://github.com/cisco-system-traffic-generator/trex-profiles)** > > traffic profiles repository contributions . Contribute to cisco-system-traffic-generator/trex-profiles development by creating an account on GitHub. ---
**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\ **Post date:** [October 18, 2021, 7:29pm UTC](https://forum.suricata.io/t/sharing-good-sources-of-sample-captures/1766/5 "2021-10-18T19:29:45Z")
Another one by Packetbeat, looks like a good source for varied pcaps: > **[beats/packetbeat/tests/system/pcaps at master · elastic/beats](https://github.com/elastic/beats/tree/master/packetbeat/tests/system/pcaps)** > > master/packetbeat/tests/system/pcaps ---
**Author:** ![Parag](https://avatars.discourse-cdn.com/v4/letter/p/a5b964/32.png) [@Parag](https://forum.suricata.io/u/Parag)\ **Post date:** [May 26, 2022, 5:56am UTC](https://forum.suricata.io/t/sharing-good-sources-of-sample-captures/1766/6 "2022-05-26T05:56:07Z")
These are some good details about sample captures. But are they safe to download and use? I mean will this act maliciously if not caught by Suricata somehow? ---
**Author:** ![suricatalfon](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/suricatalfon/32/385_2.png) [@suricatalfon](https://forum.suricata.io/u/suricatalfon)\ **Post date:** [May 26, 2022, 8:05am UTC](https://forum.suricata.io/t/sharing-good-sources-of-sample-captures/1766/7 "2022-05-26T08:05:35Z")
> **[zeek/testing/btest/Traces at master · zeek/zeek](https://github.com/zeek/zeek/tree/master/testing/btest/Traces)** > > master/testing/btest/Traces > **[detections/pcaps at master · 401trg/detections](https://github.com/401trg/detections/tree/master/pcaps)** > > master/pcaps > **[GitHub - automayt/ICS-pcap: A collection of ICS/SCADA PCAPs](https://github.com/automayt/ICS-pcap)** > > A collection of ICS/SCADA PCAPs. Contribute to automayt/ICS-pcap development by creating an account on GitHub. > **[Capturas de tráfico](https://darfe.es/es/capturas)** > > darfe ---
**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\ **Post date:** [May 26, 2022, 1:46pm UTC](https://forum.suricata.io/t/sharing-good-sources-of-sample-captures/1766/8 "2022-05-26T13:46:03Z")
That is a valid question. The sources we are listing here are safe, as far as we can tell. They also, many a times, include their own safety instructions. I would consider that if you are just running Suri over these in pcap mode, Suri would just be analyzing past flow activities, therefore, in theory, there shouldn’t be a risk. But even then, most threat hunters I see around will run such pcaps from within some virtual environment, to avoid surprises. It’s probably better to wait for an answer from someone who has more experience in this, as I’m just a developer 😛 ---
**Author:** ![suricatalfon](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/suricatalfon/32/385_2.png) [@suricatalfon](https://forum.suricata.io/u/suricatalfon)\ **Post date:** [May 27, 2022, 5:03am UTC](https://forum.suricata.io/t/sharing-good-sources-of-sample-captures/1766/9 "2022-05-27T05:03:12Z")
Hi, Ju In principle, and using meerkat in offline mode, there should be no problem with any pcap. Suricata works, generates the logs and there is nothing else. I understand it like this. I have worked with many of those pcaps, including the ones at [https://www.malware-traffic-analysis.net/](https://www.malware-traffic-analysis.net/) and I am still alive. 😉 ---
**Author:** ![Parag](https://avatars.discourse-cdn.com/v4/letter/p/a5b964/32.png) [@Parag](https://forum.suricata.io/u/Parag)\ **Post date:** [May 31, 2022, 5:16am UTC](https://forum.suricata.io/t/sharing-good-sources-of-sample-captures/1766/10 "2022-05-31T05:16:52Z")
Thanks guys for the feedback. ---
**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\ **Post date:** [December 2, 2025, 7:32pm UTC](https://forum.suricata.io/t/sharing-good-sources-of-sample-captures/1766/11 "2025-12-02T19:32:47Z")
Saw this one today, I like the name 😃 > **[The Ultimate PCAP | Weberblog.net](https://weberblog.net/the-ultimate-pcap/)** “This “ **Ultimate PCAP** ” is meant to be a **single point of source for Wireshark samples**. […] Currently, it has **90+ different protocols** and hundreds of variants, such as IPv6 and legacy IP traffic, different DNS query types, ICMP error codes, and so on.” ---
**Author:** ![pevma](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/pevma/32/29_2.png) [@pevma](https://forum.suricata.io/u/pevma)\ **Post date:** [December 3, 2025, 6:32am UTC](https://forum.suricata.io/t/sharing-good-sources-of-sample-captures/1766/12 "2025-12-03T06:32:58Z")
Forgot to add that before - there is also the sources in the video here [![](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/2/2ab2483e4eea690251a500c05d67937cce7b59a2.jpeg "Webinar: Where to find free and public PCAPs for Suricata") ](https://www.youtube.com/watch?v=4n8B9NxbWAE)