title: Is there a way to determine all base64 encoded traffic to/from a large packet capture?
body: <p>I have a large (8GB) packet capture (.pcap) that has generated a number of Snort alerts. </p>
  
  <p>I suspect that some data may have been exfiltrated while encoded. Is there an easy way to determine if anything has gone out as Base64 encoded without having to sift through Wireshark to find the problem, perhaps using the terminal?</p>
  
  <p>My worry is that an actor could conduct lateral movement within the system and extract files to a 3rd party system which wouldn't be recognized by Snort alerts.</p>
  
  <p>I've tried parsing the large .pcap into 200MB files to allow closer examination (my VM has memory limitations).</p>