Capture and analyze network traffic using Wireshark and tshark to reconstruct network events, extract artifacts, and identify malicious communications.
Capture and analyze network traffic using Wireshark and tshark to reconstruct network events, extract artifacts, and identify malicious communications.
When analyzing captured network traffic (PCAP files) from a security incident
For identifying command-and-control (C2) communications in captured traffic
When reconstructing data exfiltration activities from packet captures
During malware analysis to identify network indicators of compromise
For extracting files, credentials, and artifacts transferred over the network
Detection Gaps & Validation
A PCAP only contains what the sensor actually saw, decrypted to the depth your tooling supports. Account for these blind spots:
Capture truncation and drops. A snaplen below the MTU (tcpdump -s too small) gives you headers without payloads, so --export-objects silently produces nothing. Run capinfos and check for dropped packets, snaplen, and whether the duration covers the incident window — "no files extracted" is often truncation, not absence. Missing one direction (asymmetric routing/SPAN) breaks stream reassembly.
Encrypted payloads hide the content, not the metadata. TLS 1.3/QUIC, DoH/DoT, and SSH mean you can't read bodies without keys. Pivot to what stays visible: SNI (often, but ECH/encrypted ClientHello blocks it), JA3/JA3S fingerprints, certificate issuers/validity, connection sizes, and timing. Don't conclude traffic is benign just because you can't decrypt it.
C2 hides in normal-looking flows. Beaconing with jitter defeats fixed-interval filters; domain fronting and traffic over 443/53 blend in. Validate a suspected beacon by computing inter-arrival variance across the whole capture and correlating the destination with endpoint process/DNS logs, not a single frame.time_delta filter.
Cross-corroborate and verify, don't trust one heuristic. Reassembled TCP streams can be incomplete if SYN/retransmits are missing; carved files may be partial. Hash every extracted object and check it against threat intel/VirusTotal before calling it malware, and confirm the file actually transferred (response 200 + content-length) versus an aborted request.
Interpretation false positives. Long/random DNS labels are frequently CDNs, AV telemetry, and analytics — not always tunneling; self-signed certs are common on internal services. NetworkMiner OS/port guesses are heuristic. Verify clock/timezone of the capture host before building a timeline, and treat plaintext "credentials" as candidates until you confirm the service and account.
Prerequisites
Wireshark or tshark installed for packet analysis
PCAP/PCAPNG files from network captures (tcpdump, Wireshark, network TAP)
NetworkMiner for automated artifact extraction
Sufficient RAM for large capture files (1GB+ PCAPs need 8GB+ RAM)
Understanding of TCP/IP, HTTP, DNS, TLS protocols
GeoIP databases for IP geolocation
Workflow
Step 1: Prepare and Validate the Capture File
# Install Wireshark and tsharksudo apt-get install wireshark tshark
# Verify the PCAP file
capinfos /cases/case-2024-001/network/capture.pcap
# Output includes: file type, packet count, capture duration, data size# Example output:# File name: capture.pcap# File type: Wireshark/tcpdump/... - pcap# Number of packets: 1,245,678# File size: 856 MB# Data size: 823 MB# Capture duration: 3600.123456 seconds# First packet time: 2024-01-15 14:00:00.000000# Last packet time: 2024-01-15 15:00:00.123456# Hash the PCAP for integritysha256sum /cases/case-2024-001/network/capture.pcap \
> /cases/case-2024-001/network/pcap_hash.txt
# Get a protocol hierarchy statistics overview
tshark -r /cases/case-2024-001/network/capture.pcap -q -z io,phs
Network grep for pattern matching in packet content
capinfos
PCAP file statistics and metadata utility
mergecap
Merge multiple PCAP files into a single capture
Common Scenarios
Scenario 1: Malware C2 Communication Analysis
Load PCAP in Wireshark, identify beaconing patterns to external IPs, examine TLS certificates for self-signed or unusual issuers, extract HTTP POST data containing encoded commands, correlate C2 IPs with threat intelligence feeds.
Scenario 2: Data Exfiltration Detection
Analyze traffic statistics for unusually large outbound transfers, examine DNS query lengths for DNS tunneling indicators, track FTP and HTTP file uploads to external servers, reconstruct exfiltrated files from packet data.
Scenario 3: Lateral Movement in Enterprise Network
Filter for SMB, RDP, WMI, and PSExec traffic between internal hosts, identify credential usage patterns across multiple systems, trace the propagation path of the attacker through the network, correlate with Windows Event Log authentication events.
Scenario 4: Web Application Attack Reconstruction
Filter HTTP traffic to the web server, identify SQL injection, XSS, and directory traversal attempts, follow the TCP stream of the successful exploit, extract uploaded webshells or payloads, document the attack chain for the incident report.
