# PCAP Analysis Workflow Step-by-step guide for analyzing packet captures with Wireshark and tshark, focused on malware traffic identification. ## Initial Assessment ### Quick Statistics ```bash # Capture file info capinfos capture.pcap # Protocol hierarchy tshark -r capture.pcap -q -z io,phs # I/O statistics (packets per second) tshark -r capture.pcap -q -z io,stat,1 # Endpoint statistics tshark -r capture.pcap -q -z endpoints,ip tshark -r capture.pcap -q -z endpoints,tcp # Conversation list tshark -r capture.pcap -q -z conv,tcp tshark -r capture.pcap -q -z conv,udp ``` ### Wireshark Quick Checks 1. Open capture in Wireshark 2. View Statistics > Protocol Hierarchy 3. View Statistics > Conversations 4. View Statistics > Endpoints 5. View Statistics > I/O Graphs (look for spikes) --- ## Common Display Filters ### By Protocol ``` # DNS dns dns.qr == 0 # DNS queries only dns.qr == 1 # DNS responses only dns.flags.rcode == 3 # NXDOMAIN responses dns.qry.type == 16 # TXT record queries dns.resp.len > 500 # Large DNS responses # HTTP http http.request # HTTP requests only http.response # HTTP responses only http.request.method == "POST" # POST requests http.request.method == "GET" # GET requests http.response.code >= 400 # Error responses http.content_type contains "executable" http.user_agent contains "python" # TLS/SSL tls tls.handshake # TLS handshakes tls.handshake.type == 1 # Client Hello tls.handshake.type == 2 # Server Hello tls.handshake.type == 11 # Certificate tls.handshake.extensions_server_name # SNI present # SMB smb || smb2 smb2.cmd == 5 # Create (file open) smb2.cmd == 8 # Read smb2.cmd == 9 # Write # SMTP smtp smtp.req.command == "DATA" smtp.req.command == "AUTH" ``` ### By Behavior ``` # Possible C2 beaconing (HTTP to single host) http.request && ip.dst == # Large data transfers tcp.len > 10000 # Connections to specific port tcp.dstport == 4444 # Common Metasploit port tcp.dstport == 8443 # Common C2 port tcp.dstport == 1337 # Common backdoor port # Failed connections tcp.flags.syn == 1 && tcp.flags.ack == 0 && tcp.analysis.retransmission # Non-standard port usage (tcp.dstport != 80 && tcp.dstport != 443 && tcp.dstport != 53) && tcp.flags.syn == 1 # Outbound traffic only ip.src == && !ip.dst == # Exclude known good !(dns.qry.name contains "microsoft.com") && !(dns.qry.name contains "google.com") ``` ### Malware-Specific ``` # Possible shellcode download http.request.uri contains ".exe" || http.request.uri contains ".dll" || http.request.uri contains ".scr" || http.request.uri contains ".ps1" # Base64 in URLs (possible encoded C2) http.request.uri matches "[A-Za-z0-9+/=]{20,}" # Possible data exfiltration (large POST) http.request.method == "POST" && http.content_length > 100000 # PowerShell download cradle http.user_agent contains "PowerShell" || http.user_agent contains "WindowsPowerShell" # Cobalt Strike default profile http.request.uri == "/submit.php" || http.request.uri matches "/[a-zA-Z]{4}$" # Metasploit patterns http.request.uri contains "INITM" || tcp.payload contains "METERPRETER" ``` --- ## Analysis Workflows ### Workflow 1: Quick Triage 1. Check protocol hierarchy for unexpected protocols 2. Review DNS queries for suspicious domains 3. Check HTTP requests for executable downloads 4. Look at TLS SNI values for unknown domains 5. Check for connections to known malicious IPs ### Workflow 2: C2 Identification 1. Filter for HTTP/HTTPS traffic to external IPs 2. Sort by conversation to find most active connections 3. Follow TCP streams for suspicious conversations 4. Check User-Agent strings for non-browser agents 5. Look for beaconing patterns (regular intervals) 6. Extract JA3/JA3S fingerprints and look up ### Workflow 3: Data Exfiltration 1. Sort conversations by bytes transferred (largest first) 2. Filter POST requests and check payload sizes 3. Look for DNS TXT queries with encoded data 4. Check for connections to cloud storage services 5. Look for ICMP traffic with unusual payload sizes 6. Check for encrypted traffic on non-standard ports ### Workflow 4: Lateral Movement 1. Filter for SMB traffic between internal hosts 2. Look for PsExec named pipe creation 3. Check for WMI traffic (port 135 + high ports) 4. Look for RDP connections (port 3389) between workstations 5. Check for Pass-the-Hash patterns in SMB authentication 6. Look for port scanning activity between internal hosts --- ## Tshark One-Liners ```bash # Top 20 DNS queries by frequency tshark -r capture.pcap -Y "dns.qr==0" -T fields -e dns.qry.name | \ sort | uniq -c | sort -rn | head -20 # All unique destination IPs with packet counts tshark -r capture.pcap -T fields -e ip.dst | sort | uniq -c | sort -rn | head -30 # HTTP POST requests with hosts and URIs tshark -r capture.pcap -Y "http.request.method==POST" -T fields \ -e frame.time -e ip.src -e ip.dst -e http.host -e http.request.uri # Extract all URLs tshark -r capture.pcap -Y "http.request" -T fields \ -e http.host -e http.request.uri | \ awk '{print "http://" $1 $2}' # TLS SNI values tshark -r capture.pcap -Y "tls.handshake.extensions_server_name" \ -T fields -e tls.handshake.extensions_server_name | sort -u # All unique User-Agent strings tshark -r capture.pcap -Y "http.user_agent" -T fields \ -e http.user_agent | sort -u # Connections by source IP (SYN packets) tshark -r capture.pcap -Y "tcp.flags.syn==1 && tcp.flags.ack==0" \ -T fields -e ip.src | sort | uniq -c | sort -rn # Export HTTP objects tshark -r capture.pcap --export-objects http,./http_objects/ # Large DNS responses (possible tunneling) tshark -r capture.pcap -Y "dns.qr==1 && udp.length>200" \ -T fields -e dns.qry.name -e udp.length # Time between packets for specific flow tshark -r capture.pcap -Y "ip.addr==" -T fields \ -e frame.time_delta_displayed -e ip.src -e ip.dst -e tcp.dstport ``` --- ## File Extraction ### From HTTP ```bash # Using tshark tshark -r capture.pcap --export-objects http,./extracted/ # Using Wireshark: File > Export Objects > HTTP ``` ### From SMB ```bash tshark -r capture.pcap --export-objects smb,./extracted_smb/ ``` ### From TCP Streams ```bash # Export specific TCP stream as raw data tshark -r capture.pcap -q -z "follow,tcp,raw," > stream.raw # In Wireshark: right-click packet > Follow > TCP Stream > Save As ``` ### Post-Extraction Analysis ```bash # Identify file types file extracted/* # Calculate hashes sha256sum extracted/* # Check for executables find extracted/ -exec file {} \; | grep -i "executable\|PE32\|ELF" ``` --- ## Tips - Start with the broadest view (protocol hierarchy) and narrow down - Use conversation statistics to identify high-volume flows - Compare timestamps across different suspicious activities - Save useful display filters as filter buttons in Wireshark - Use Wireshark coloring rules to highlight suspicious traffic - Export suspicious streams for detailed offline analysis - Use `editcap` to split large captures into manageable time slices - Use `mergecap` to combine captures from multiple collection points