Statistics and I/O
Before going packet-by-packet, orient to the full capture with Wireshark's statistical views: conversations (who talked to whom and how much), endpoints (all unique IPs ranked by traffic), protocol hierarchy (what fraction of traffic is each protocol), and the I/O graph (traffic volume over time). These views reveal the attack timeline, the top talkers, and beaconing patterns in minutes rather than hours.
You've loaded a 4-hour capture with 8.3 million packets. Before applying any display filters, you open Conversations to find the top 10 byte-count sessions — one stands out: 47 MB from an internal workstation to an unusual external IP. The I/O graph shows that the high-volume session corresponds to a 90-second window at 02:47 UTC — the exfiltration. Protocol Hierarchy shows 94% of traffic is TLS, but 3% is HTTP — unusual for a corporate network that should route everything through HTTPS. That 3% unencrypted HTTP is worth investigating. All of this orientation took 4 minutes before touching a single packet.
Conversations — Top Talkers
Statistics → Conversations
═══════════════════════════════════════════════════════════════════
Shows all unique (srcIP, dstIP, srcPort, dstPort) tuples with:
├── Address A → Address B: both IPs
├── Port A, Port B: both ports (TCP/UDP view)
├── Packets: packet count both directions combined
├── Bytes: total bytes both directions
├── Packets A→B and Bytes A→B: one direction
├── Packets B→A and Bytes B→A: other direction
├── Duration: session duration
├── bps: bits per second
└── Start and Stop times
Tabs: Ethernet / IPv4 / IPv6 / TCP / UDP
Key forensic uses:
1. Sort by Bytes (descending) → find largest data transfers immediately
→ Exfiltration candidates are at the top
2. Sort by Duration (descending) → find long-lived connections
→ C2 keep-alive, persistent reverse shells
3. Sort by Packets (descending) → find highest-frequency connections
→ Beaconing (many small packets at regular intervals)
4. Filter to external IPs only → focus on exfil/C2, not internal noise
→ Click "Limit to display filter" after applying an external IP filter
5. Right-click any conversation → "Apply as Filter → Selected"
→ Instantly isolates that specific session in the packet list
6. "Follow Stream" button from Conversations view
→ Opens Follow TCP Stream for the selected conversation
Endpoints — All Unique IPs
Statistics → Endpoints
═══════════════════════════════════════════════════════════════════
Shows all unique IP addresses (or MAC addresses in Ethernet view):
├── Address: IP address
├── Packets: total packets to/from this IP
├── Bytes: total bytes
├── Tx Packets/Bytes: transmitted
└── Rx Packets/Bytes: received
Forensic uses:
1. "Map" tab → geographic visualization (approximate IP geolocation)
→ Visual identification of traffic going to unexpected countries
2. Sort by Bytes → largest data receivers (exfil destinations)
3. Compare Tx vs Rx:
Tx >> Rx: this host is a data source (beaconing, uploading)
Rx >> Tx: this host is a data receiver (downloading files/payloads)
Balanced: interactive session (shell, RDP)
4. "Name Resolution" checkbox → resolve IPs to hostnames for context
(Note: resolution happens live — may slow down on large captures)
5. Combine with GeoIP plugin for country-level filtering:
Statistics → Endpoints → IPv4 → check "Map" → open in browser
Shows all destination countries at a glance
Protocol Hierarchy
Statistics → Protocol Hierarchy
═══════════════════════════════════════════════════════════════════
Shows breakdown of all protocols as percentage of total traffic:
▼ Frame: 100% (8,347,293 packets)
▼ Ethernet: 100%
▼ IPv4: 99.2%
▼ TCP: 95.8%
▼ TLS: 91.4% ← expected (most modern traffic is TLS)
▼ HTTP: 3.2% ← suspicious! Should be near 0% in TLS-only env
▼ SMB2: 0.8% ← lateral movement indicator
▼ Kerberos: 0.4% ← authentication traffic
▼ UDP: 3.4%
▼ DNS: 2.9%
▼ QUIC: 0.5%
▼ ICMP: 0.1% ← if > 0.5%, ICMP tunnel?
▼ ARP: 0.8%
What to look for:
├── HTTP in a TLS-enforced environment = plaintext C2 or misconfiguration
├── SMB2 with traffic to external IPs = SMB tunnel or relay attack
├── ICMP with more than trace percentage = possible ICMP tunneling
├── DNS with > 5% of traffic = potential DNS tunneling
├── Unknown protocols = custom C2 protocol or novel technique
└── Kerberos spike = brute force or AS-REP/Kerberoasting attempt
Right-click a protocol → "Apply as Filter"
→ Instantly shows only that protocol's packets
I/O Graph — Traffic Over Time
Statistics → I/O Graph
═══════════════════════════════════════════════════════════════════
Plots traffic volume (bytes/sec or packets/sec) over time.
X-axis: time (configurable interval: 1sec, 10sec, 1min)
Y-axis: value (packets/sec, bytes/sec, bits/sec)
Multiple "lines" can be plotted simultaneously — add filters:
Line 1 (blue): [all traffic]
Line 2 (red): ip.dst == 185.220.101.47 and tcp.flags.push==1
Line 3 (green): dns
What I/O graph reveals:
1. Attack timeline: sharp spike at specific time = exfil or scan
┌────────────────────────────────────────────────────────────┐
│ ▓ │ High
│ ▓▓▓ ▒ │
│ ▒▒ ▓▓▓▓▒▒ ▒▒▒▒▒▒▒▒ │
│▒▒▒▒▓▓▓▓▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ │ Low
└────────────────────────────────────────────────────────────┘
00:00 02:47 exfil spike
2. Beaconing: regular pattern at specific interval
┌────────────────────────────────────────────────────────────┐
│ ▒ ▒ ▒ ▒ ▒ ▒ ▒ ▒ ▒ ▒ ▒ ▒ ▒ ▒ │
│ ▒▒ ▒▒▒ ▒▒▒ ▒▒▒ ▒▒▒ ▒▒▒ ▒▒▒ ▒▒▒ ▒▒▒ ▒▒▒ ▒▒▒ ▒▒▒ ▒▒▒ ▒▒▒ ▒ │
└────────────────────────────────────────────────────────────┘
← 60-second intervals → regular beacon pattern
3. Exfiltration: sustained high volume to one destination
Filter to: ip.dst == suspect_ip
→ Sustained elevated line = exfiltration in progress
Keyboard shortcut: Ctrl+Alt+Shift+I (open I/O graph)
The biggest mistake when opening a large PCAP is immediately applying a display filter based on a known IOC and missing everything else. Always start with the statistical views: Conversations tells you the top byte-count sessions (exfiltration candidates), Protocol Hierarchy tells you what unusual protocols are present (C2 channels), and the I/O Graph tells you the attack timeline (when was the spike). Spend 5 minutes in statistics before touching the packet list. You'll often find additional C2 channels or exfiltration sessions you didn't know to look for — because statistics surfaces anomalies by volume, not just by the IOC you walked in with.
Q & A
Q: The I/O graph shows a regular pattern of spikes every 60 seconds. How do I confirm this is beaconing and not a legitimate update checker?
Regular 60-second spikes are a beaconing candidate. To confirm vs legitimate: (1) Filter to the specific session: in Conversations, find the src+dst pair responsible for the spikes. Right-click → Apply as Filter. Does the I/O graph show that this pair accounts for the entire periodic pattern? (2) Follow HTTP Stream: are the requests identical (same URI, same headers, same payload size every time)? Legitimate update checkers often vary User-Agent strings or request different resource versions. C2 beacons typically send identical check-in requests. (3) Check response content: legitimate update checks return either "no update" (304 Not Modified) or actual update content. C2 returns base64-encoded command data. (4) Process correlation: check endpoint telemetry (Sysmon, EDR) for which process made the connection. "chrome.exe" connecting to update.googleapis.com every 60 seconds = legitimate. "svchost.exe" connecting to an IP that resolves to nothing = suspicious. (5) Weekend and overnight behavior: a human-operated process checks-in only during business hours. Malware beacons 24/7 regardless of whether a user is logged in.