Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.
Instrucciones de origen · Vista previa de solo lectura
name
analyzing-network-traffic-with-wireshark
description
Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.
Investigating suspected network intrusions by examining packet-level evidence of command-and-control traffic, data exfiltration, or lateral movement
Diagnosing network performance issues such as retransmissions, fragmentation, or DNS resolution failures
Analyzing malware communication patterns by capturing traffic from sandboxed or isolated hosts
Validating firewall and IDS rules by confirming what traffic is actually traversing network segments
Extracting files, credentials, or indicators of compromise from captured network sessions
Do not use to capture traffic on networks without authorization, to intercept private communications without legal authority, or as a substitute for full-featured SIEM platforms in production monitoring.
Detection Gaps & Validation
You only see what the tap delivers: a SPAN port that mirrors one direction, or oversubscription dropping frames, makes beaconing look intermittent. Confirm with tshark -r cap.pcapng -q -z io,phs and check the capture's dropped-packet count before concluding traffic is absent.
Encrypted exfil/C2 hides from display filters: DoH/DoT (tcp.port==443/853) carries no dns.qry.name to grep — your .xyz TLD filter returns nothing. Pivot to tls.handshake.extensions_server_name (SNI), JA3/JA3S, and tcp.len periodicity instead of assuming the host is clean.
Display filter != capture filter: a capture BPF of port 53 permanently discards the DoH/DoT and non-53 tunnels you later want; capture broad, filter narrow at analysis time.
Low-and-slow beats the eye: beacons with jitter won't stand out in a packet list. Use -z io,stat,1 and -z conv,tcp sorted by duration to surface long, low-byte conversations to one destination.
Validate your filter fires: replay a known-bad sample with tcpreplay -i eth0 known_c2.pcap (or open it directly) and confirm your display filter (e.g., dns.qry.name matches "[a-f0-9]{30,}") actually matches the malicious frames; a zero-row result means the field path or operator is wrong.
FP tuning: TLS SNI to CDNs, Windows update, and corporate DoH resolvers trigger naive TLD/long-label filters; baseline and whitelist before alerting.
Prerequisites
Wireshark 4.0+ and tshark command-line utility installed
Root/sudo privileges or membership in the wireshark group for live packet capture
Network interface access (physical NIC, span port, or network tap) to the monitored segment
Sufficient disk space for packet capture files (estimate 1 GB per minute on busy gigabit links)
Familiarity with TCP/IP protocols, HTTP, DNS, TLS, and SMB at the packet level
Workflow
Step 1: Configure Capture Environment
Set up the capture interface and filters to target relevant traffic:
# List available interfaces
tshark -D
# Start capture on eth0 with a capture filter to limit scope
tshark -i eth0 -f "host 10.10.5.23 and (port 80 or port 443 or port 445)" -w /tmp/capture.pcapng
# Capture with ring buffer to manage disk usage (10 files, 100MB each)
tshark -i eth0 -b filesize:102400 -b files:10 -w /tmp/rolling_capture.pcapng
# Capture on multiple interfaces simultaneously
tshark -i eth0 -i eth1 -w /tmp/multi_interface.pcapng
For Wireshark GUI, set capture filter in the Capture Options dialog before starting.
Step 2: Apply Display Filters for Targeted Analysis
# Export filtered packets to a new PCAP for evidence preservation
tshark -r capture.pcapng -Y "ip.addr == 10.10.5.23 and tcp.port == 4444" -w evidence_c2_traffic.pcapng
# Generate packet summary in CSV format
tshark -r capture.pcapng -T fields -E header=y -E separator=, -e frame.number -e frame.time -e ip.src -e ip.dst -e ip.proto -e tcp.srcport -e tcp.dstport -e frame.len > traffic_summary.csv
# Create PDML (XML) output for programmatic analysis
tshark -r capture.pcapng -T pdml > capture_analysis.xml
# Calculate capture file hash for chain of custodysha256sum capture.pcapng > capture_hash.txt
Key Concepts
Term
Definition
Capture Filter (BPF)
Berkeley Packet Filter syntax applied at capture time to limit which packets are recorded, reducing file size and improving performance
Display Filter
Wireshark-specific filter syntax applied to already-captured packets for focused analysis without altering the capture file
PCAPNG
Next-generation packet capture format supporting multiple interfaces, name resolution, annotations, and metadata in a single file
TCP Stream
Reassembled sequence of TCP segments representing a complete bidirectional conversation between two endpoints
Protocol Dissector
Wireshark module that decodes a specific protocol's fields and structure, enabling deep inspection of packet contents
IO Graph
Time-series visualization of packet or byte rates over the capture duration, useful for identifying traffic spikes or beaconing
Tools & Systems
Wireshark 4.0+: GUI-based packet analyzer with protocol dissectors for 3,000+ protocols, stream reassembly, and export capabilities
tshark: Command-line version of Wireshark for headless capture, batch processing, and scripted analysis pipelines
tcpdump: Lightweight packet capture tool for quick captures on remote systems without GUI dependencies
mergecap: Wireshark utility for combining multiple capture files into a single PCAP for unified analysis
editcap: Wireshark utility for splitting, filtering, and converting between capture file formats
Common Scenarios
Scenario: Investigating Suspected Data Exfiltration via DNS Tunneling
Context: The SOC team detected unusually high DNS query volumes from a workstation (10.10.3.45) to an external domain. The SIEM alert flagged DNS queries averaging 200 per minute compared to the baseline of 15. A packet capture was initiated from the network tap on the workstation's VLAN.
Approach:
Capture traffic from the workstation's subnet using tshark -i eth2 -f "host 10.10.3.45 and port 53" -w dns_exfil_investigation.pcapng
