PCAP Analysis
Packet captures are the ground truth of network forensics — every byte the attacker sent and received is preserved if you have a TAP or SPAN port recording the traffic. This chapter covers reading PCAPs with Wireshark and tshark, extracting files and credentials, and reconstructing attacker activity from network evidence.
Your network TAP recorded all traffic for the compromised server's subnet for the past 72 hours. You have an 18 GB PCAP file. The investigation question: what did the attacker exfiltrate, and to where? This chapter walks through efficiently analyzing a large PCAP to extract the answers — which hosts the attacker communicated with, what protocols they used, and what data they transferred.
tshark — Command-Line PCAP Analysis
For large PCAPs, tshark (the CLI version of Wireshark) is faster and scriptable:
PCAP="/cases/CASE-2026-009/network/full-capture.pcap"
CASE_DIR="/cases/CASE-2026-009/network"
# Step 1: Overview — who talked to whom?
tshark -r $PCAP -q -z conv,tcp | head -50
# Shows top TCP conversations: src, dst, bytes, packets
# Step 2: Unique external IPs (filter out RFC1918 internal)
tshark -r $PCAP -T fields -e ip.dst | \
grep -vE "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|0\.)" | \
sort | uniq -c | sort -rn | head -30
# Step 3: DNS queries — what did the host resolve?
tshark -r $PCAP -Y "dns.flags.response == 0" -T fields \
-e frame.time -e ip.src -e dns.qry.name | \
sort -k3 | uniq -c | sort -rn | head -50
# Step 4: HTTP requests — what was browsed or downloaded?
tshark -r $PCAP -Y "http.request" -T fields \
-e frame.time -e ip.src -e http.host -e http.request.uri \
-e http.request.method | head -100
# Step 5: Large data transfers — potential exfiltration
tshark -r $PCAP -z io,stat,0,"ip.dst==185.220.101.47" | head -20
# Shows bytes/packets to specific destination over time
# Step 6: Extract all HTTP objects (files transferred over HTTP)
tshark -r $PCAP --export-objects http,$CASE_DIR/http-objects/
ls -la $CASE_DIR/http-objects/ | sort -k5 -rn | head -20Wireshark Investigation Workflow
Wireshark Investigation Workflow
═══════════════════════════════════════════════════════════════════
Opening large PCAPs:
- Use tshark to pre-filter to interesting traffic
- tshark -r full.pcap -Y "ip.addr==185.220.101.47" -w suspect.pcap
- Open the smaller filtered PCAP in Wireshark
Key Wireshark features for DFIR:
1. Statistics → Protocol Hierarchy
Shows what percentage of traffic is each protocol
Unusual: high HTTPS to a single external IP
DNS over non-standard ports
HTTP on non-standard ports
2. Statistics → Conversations
Sort by bytes (column) to find largest transfers
→ Exfiltration candidates: large transfers to external IPs
3. Statistics → DNS → Queries
Lists all resolved domains
Sort by count (repeated C2 beacon DNS queries)
Look for: high-entropy domains (DGA), .onion, unfamiliar TLDs
4. File → Export Objects → HTTP/DICOM/SMB2
Reconstructs files from packet stream
Recovers downloaded tools, exfiltrated files (if unencrypted)
5. Follow TCP Stream (right-click any packet)
Shows the full conversation content in readable form
For cleartext HTTP: shows complete request + response
For credentials: may show Base64-encoded or cleartext passwords
Extracting Files and Credentials from PCAP
PCAP="/cases/CASE-2026-009/network/filtered-suspect.pcap"
CASE_DIR="/cases/CASE-2026-009/network"
# Export HTTP transferred files
tshark -r $PCAP --export-objects http,$CASE_DIR/http-objects/
# Export SMB transferred files (lateral movement / exfil via file shares)
tshark -r $PCAP --export-objects smb,$CASE_DIR/smb-objects/
# Export TFTP files (often used for downloading implants in old networks)
tshark -r $PCAP --export-objects tftp,$CASE_DIR/tftp-objects/
# Find credential patterns in cleartext traffic
# HTTP Basic auth (Base64 encoded)
tshark -r $PCAP -Y "http.authorization" -T fields \
-e frame.time -e ip.src -e http.host -e http.authorization
# FTP credentials
tshark -r $PCAP -Y "ftp.request.command == USER or ftp.request.command == PASS" \
-T fields -e frame.time -e ip.src -e ftp.request.arg
# POP3 credentials
tshark -r $PCAP -Y "pop.request" -T fields \
-e frame.time -e ip.src -e pop.request
# Hash all extracted objects for VT lookup
for f in $CASE_DIR/http-objects/*; do
size=$(stat -c%s "$f")
if [ $size -gt 1000 ]; then
sha256=$(sha256sum "$f" | cut -d' ' -f1)
echo "$sha256 $(basename $f) ${size} bytes"
fi
done | tee $CASE_DIR/extracted-file-hashes.txtNetworkMiner for Passive Analysis
NetworkMiner parses PCAPs and automatically categorizes hosts, credentials, files, and messages without requiring filter syntax:
NetworkMiner Capabilities
═══════════════════════════════════════════════════════════════════
Input: PCAP or live capture
Output: categorized artifacts organized by host
Hosts tab:
- Every IP seen, with OS fingerprint (TTL + TCP window analysis)
- Hostname from DNS responses
- Open ports observed in the capture
→ Use to quickly identify all systems involved
Files tab:
- Automatically reassembled files from HTTP, FTP, SMB, SMTP
- Sorted by protocol, size, filename
- Click to open in default application
→ Find attacker tools without writing tshark filters
Credentials tab:
- HTTP Basic, FTP, POP3, IMAP, SMTP AUTH credentials
- Shown in cleartext
→ Immediate credential exposure assessment
Messages tab:
- Email and chat messages (if not encrypted)
- Useful for phishing email capture (if internal relay is in scope)
Sessions tab:
- All TCP/UDP sessions with size and duration
- Sort by bytes transferred to find exfiltration candidates
Q & A
Q: All the suspicious traffic is HTTPS (TLS encrypted). Is the PCAP useless for this traffic?
No — HTTPS PCAPs still provide significant forensic value even without decryption. You can see: (1) Connection metadata: source IP, destination IP, destination port, timestamps, and session duration — enough to identify C2 patterns. (2) TLS SNI (Server Name Indication): the domain name the client is connecting to, sent in cleartext in the ClientHello. tshark -Y "tls.handshake.type==1" -T fields -e tls.handshake.extensions_server_name extracts all domains from HTTPS traffic. (3) JA3/JA3S fingerprints: the TLS handshake parameters (cipher suites, extensions, elliptic curves) are in cleartext and create a fingerprint of the client and server TLS stack. Unusual JA3 hash = potential malware C2 (covered in Ch32). (4) Certificate details: the server certificate is transmitted in cleartext. Self-signed or recently-issued certificates on non-standard TLDs are red flags. (5) Traffic patterns: beacon regularity, data volume — visible in the packet metadata even without decrypting payload. If you have the server's TLS private key or have SSLKEYLOGFILE from the client browser, Wireshark can decrypt the PCAP entirely: Preferences → Protocols → TLS → RSA keys list.