Articles

Mist Dynamic PCAP - FAQ

What you need to know to get instant pcap analysis with your Mist AI system

Over the last 2 years, Mist users have opened tens of thousands of PCAPs directly from their dashboard to analyze with CloudShark. This partner integration delivers an entirely web-based way to connect anomalous network events with the raw PCAP. This was accomplished entirely frictionlessly, without any configuration or setup on behalf of the Mist customers.

Starting September 12th, 2022 the Mist Dynamic PCAP feature will require a CloudShark Personal account to access the service.

What’s happening?

The API Token used by Mist to upload captures from all of their customers to CloudShark is expiring. Access to the service without an account will be suspended. 

What do I need to do?

Create a CloudShark Personal account before September 12th, 2022 and configure a CloudShark API Token in your Mist Dashboard. Then, continue using the features and capabilities exactly as you had before.

Will it still be frictionless / easy?

Yes! After setting up your API token within your Mist Settings, uploads to CloudShark will continue to work exactly as they had before. 

What additional features do I get with an account?

With a CloudShark Personal account, you get login-protected access to your uploaded PCAPs  and links that no longer expire after an hour! Having an account allows you to comment and annotate packets, upload all your prior uploads in one place, apply tags, organize, and search across uploaded files.

Since uploads don’t expire, you can also share them by copying and pasting the CloudShark URL! This makes it easy to share raw PCAP data with another analyst, colleague, vendor, or network provider.

CloudShark Personal also lets you build and define custom analysis profiles and decode settings for troubleshooting in different scenarios. 

Is CloudShark free?

No. CloudShark Personal is $29/month with a yearly subscription. 

How many devices can I use this with?

CloudShark access is configured globally, for all of the devices in your network. It is unlimited, and a single account can be used for all of them.

Does it work for more than just Mist?

Yes! CloudShark has a robust API that makes it easy to integrate with other systems in your network. You can also drag+drop PCAP files into CloudShark no matter where they came from. Store traffic from any of your network devices all in the same place, and merge files together to get a complete view of an issue.

Can my whole team get access?

If you have multiple NOC employees, or different departments frequently looking at PCAP traffic, a CloudShark Hosted Enterprise server may be a better option for your team. It is a private server that we manage for you. Contact <sales@qacafe.com> for more information.