Another quick question, the docs mention automated...
# neuvector_suse-securityn
nice-businessperson-14225
11/04/2025, 4:53 PMAnother quick question, the docs mention automated packet capture on network violations, but they're a little bit scarce on how to configure/enable that. As far as I can tell there is no packet capture on implicit denies, so I imagine only some events trigger packet captures. Just wondering how that works. Thanks :)
q
quaint-candle-18606
11/04/2025, 4:55 PMYes, pcap happens automagically on known threats.
quaint-candle-18606
11/04/2025, 4:58 PMThere is no current linear way to set up automatic packet captures for events, but you could write a response rule that triggered a web hook that then circled back with an API request. Currently.
quaint-candle-18606
11/04/2025, 4:58 PMAdditionally, DLP violations do also trigger a packet capture.
n
nice-businessperson-14225
11/04/2025, 4:59 PMWhat's considered a known threat? Explicit network denies? WAF? Or are these hardcoded in NeuVector?
Thanks a lot for the help btw. I appreciate it. I'm just trying to wrap my head around all the wondeful features NeuVector has 🙂
q
quaint-candle-18606
11/07/2025, 10:30 PMKnown threats are built-in.
Copy code
SYN Flood
ICMP Flood
IP Teardrop
TCP Split Handshake
Ping Death
DNS Flood DDoS
Detect SSH 1, 2, or 3
Detect SSL TLS v1.0
SSL Heartbleed
HTTP Neg Content
HTTP Smuggling
MySQL Access Deny
TCP small window
DNS Buffer Overflow
DNS Null Type
DNS Zone Transfer
ICMP Tunneling
DNS Tunneling
SQL Injection
Apache Struts RCE
K8’s Man-in-the-middle
TCP Small MSS
Cipher Overflow4 Views