Lesson 1 of 3 · 25 min read

Wireshark and tshark — PCAP Analysis Fundamentals

PCAP analysis for IR is not about exploring everything — it’s about asking the right questions of the packet data and extracting the specific fields that answer them efficiently.

Wireshark Display Filter Reference for IR

Context               | Filter
─────────────────────────────────────────────────────────────────
All traffic to/from   | ip.addr == 185.220.101.9
specific IP           |
                      |
HTTP only             | http
All HTTP requests     | http.request
POST requests         | http.request.method == "POST"
Specific URI path     | http.request.uri contains "/upload"
Specific User-Agent   | http.user_agent contains "curl"
                      |
DNS queries           | dns.flags.response == 0
DNS responses         | dns.flags.response == 1
Specific DNS name     | dns.qry.name == "evil.com"
DNS TXT records       | dns.qry.type == 16
Long DNS queries      | dns.qry.name.len > 50
                      |
TLS connections       | tls
New TLS sessions      | ssl.handshake.type == 1
Specific SNI          | tls.handshake.extensions_server_name contains "evil"
                      |
Follow one stream     | tcp.stream eq 42
Large transfers       | tcp.len > 1400
Connections to port   | tcp.dstport == 4444
                      |
ICMP tunneling        | icmp and data.len > 64
SMB (lateral movement)| smb2 or smb
RDP traffic           | tcp.dstport == 3389 or rdp

tshark Field Extraction

# Basic: list all DNS queries in a capture
tshark -r capture.pcap \
  -Y "dns.flags.response == 0" \
  -T fields \
  -e frame.time \
  -e ip.src \
  -e dns.qry.name \
  -e dns.qry.type \
  -E header=y

# HTTP request summary (method, host, URI, user agent)
tshark -r capture.pcap \
  -Y "http.request" \
  -T fields \
  -e frame.time \
  -e ip.src \
  -e ip.dst \
  -e http.request.method \
  -e http.host \
  -e http.request.uri \
  -e http.user_agent

# Extract all destination IPs and ports
tshark -r capture.pcap \
  -T fields \
  -e ip.dst \
  -e tcp.dstport \
  | sort | uniq -c | sort -rn | head -20

# Find POST requests with body (potential data exfiltration)
tshark -r capture.pcap \
  -Y "http.request.method == POST" \
  -T fields \
  -e frame.time \
  -e ip.src \
  -e ip.dst \
  -e http.host \
  -e http.request.uri \
  -e http.content_length

# TLS connections — SNI and certificate subject
tshark -r capture.pcap \
  -Y "ssl.handshake.type == 1" \
  -T fields \
  -e frame.time \
  -e ip.src \
  -e ip.dst \
  -e tls.handshake.extensions_server_name

# Extract a specific stream to a new PCAP
tshark -r capture.pcap \
  -Y "tcp.stream eq 42" \
  -w stream_42.pcap

Filtering and Working with Large PCAPs

# Split a large PCAP by time window (for IR period of interest)
editcap -A "2024-09-02 18:00:00" -B "2024-09-02 19:00:00" \
  full_capture.pcap incident_window.pcap

# Filter by IP — extract only traffic involving the suspect host
tshark -r full_capture.pcap \
  -Y "ip.addr == 185.220.101.9" \
  -w suspect_traffic.pcap

# Merge multiple PCAP files (e.g., from different capture points)
mergecap -w merged.pcap capture1.pcap capture2.pcap capture3.pcap

# Count connections per destination IP (quick scope view)
tshark -r capture.pcap \
  -T fields \
  -e ip.dst \
  | sort | uniq -c | sort -rn

# Conversation statistics (top talkers)
tshark -r capture.pcap -z conv,tcp -q

# Protocol hierarchy (what protocols are in this capture)
tshark -r capture.pcap -z io,phs -q

Following TCP Streams for C2 Investigation

# List all TCP streams in a capture
tshark -r capture.pcap -z conv,tcp -q | head -20

# Get the raw data from a specific TCP stream
tshark -r capture.pcap \
  -Y "tcp.stream eq 0" \
  -T fields \
  -e data \
  | xxd

# Follow and decode a stream's payload to ASCII
tshark -r capture.pcap \
  -q \
  -z follow,tcp,ascii,0
# (0 = stream index)

# Export stream data to file
tshark -r capture.pcap \
  -q \
  -z follow,tcp,raw,42 | xxd -r -p > stream_42_raw.bin