Most DDoS tools discard attack evidence after the incident ends. Customer reports, insurance claims, and compliance documentation all depend on forensic data that is gone by the time you need it....
Jun 19, 2026 · 10 min read →Blog
Attack postmortems.
Engineering deep-dives.
Practical guides from engineers who've been DDoS'd and learned from it.
All
Post-Mortem
Attack Analysis
Original Research
Engineering
Forensics
Integrations
Mitigations
Fundamentals
Tools
Comparisons
Get attack analysis in your inbox
Monthly postmortems, detection techniques, and original research. No fluff.
Forensics
Your Attack Data Disappears 5 Minutes After the Attack Ends
Forensics
How to read a DDoS PCAP file: step by step with Wireshark
Protocol hierarchy, conversations, I/O graphs, display filters for every attack type, tshark automation, and extracting evidence for your IS...
Mar 15, 2026 · 12 min read →
Forensics
What your PCAP can tell your ISP (and what it can't)
Most ISPs will ask for a PCAP when you request a null-route or BGP blackhole. Here's how to read what Flowtriq captures and what to present....
Feb 9, 2026 · 10 min read →