CloudShark New Features and Why Would I Use CloudShark When I Could Just Install Wireshark?

I had scheduled to watch a live demo of CloudShark the other day, but missed it due to work.

Then I recieved an email from Joe over at qacafe.com about missing it, and he stated if I had any questions to just ask.  There was no recording of the live demo, but I went to the website to check out the new features.

“Users can now securely access advanced analysis features such as follow stream, protocol conversations, VoIP call flows, protocol hierarchy, and packet colorization right in the web browser.”

I had seen CloudShark a while back over at packetlife.net. I thought it was a great idea, and even used it for some of my posts here on PacketPushers.  It seems they keep adding features, and with all the “blah blah cloud” speak flying around, maybe even some that were relevant or at least buzz worthy.  I like the CloudShark idea, and someday I hope to get my hands on either the virtual or hardware appliance to give it a go.

So this all got me thinking WireShark vs. CloudShark: do they compete or compliment? I think compliment, and I’m not even sure if they are trying to compete as CloudShark does not do captures. They just provide a way to archive, tag and view the captures.

I think this might make a decent Packet Pushers Podcast show or more like a Runt Packet to see what the direction is for CloudShark and how they see themselves positioned in the Datacenter and/or Enterprise…maybe even how Cloudshark might fit in with all the rage of OpenFlow. I’m just spitballing at this point about what could be…

I did some searches and found this post on ask.WireShark.org. There was some harsh thoughts on the CloudShark idea to start off by launching into a “why would anyone put their corporate data captures for anyone to get a hold of in the cloud” rant. There is a nice repsonse from CloudShark to the rant on that post as well.  And to add to that,  I think the point of the CloudShark.org site is to be able to see the way the product works for the appliance. After getting an idea from that demo, then you would position the appliance inside your network to be able to save your captures internally for review by analysts with accounts under your control, and without the need to have the WireShark application installed.  In most of the places I work, having WireShark installed on your desktop workstation is a big time NO if you ask for permission to install. So this is a huge benefit I see in environments where you want to be able to share and store data captures and have the ability to view online from any web browser.

What does everyone think about CloudShark, good, bad or indifferent?