PCAP Analysis

Opening a PCAP

Double-click any .pcap or .pcapng file to open it in Wireshark.

The three panes:

• Packet list (top) — one row per packet with timestamp, src/dst, protocol.
• Packet details (middle) — expand headers and fields.
• Hex dump (bottom) — raw bytes.

Display filters (not capture filters)

http                             # HTTP only
http.request.method == "POST"   # POST requests
tcp.port == 4444                # specific port
ip.addr == 192.168.1.10         # traffic to/from an IP
dns                             # all DNS queries

Filter bar turns green when the syntax is valid.

Follow a stream

Right-click any TCP/UDP/HTTP packet → Follow → TCP Stream. This reassembles the full conversation into one readable window. Flags often appear here in cleartext.

Export files

Wireshark can reassemble files transferred over HTTP, SMB, and FTP:

File → Export Objects → HTTP — lists every file the server sent; click Save All.

Useful statistics

• Statistics → Conversations — who talked to whom and how much data.
• Statistics → Protocol Hierarchy — what protocols dominate the capture.
• Statistics → HTTP → Requests — all HTTP URLs fetched.

tshark for scripting

# Extract all HTTP request URIs
tshark -r capture.pcap -Y http.request -T fields -e http.request.uri

# Extract credentials from HTTP Basic Auth
tshark -r capture.pcap -Y http.authorization -T fields -e http.authorization

# Extract DNS queries
tshark -r capture.pcap -Y dns.flags.response==0 -T fields -e dns.qry.name

Red flags in a capture

• A DNS query for an unusual domain — DNS exfiltration encodes data in hostnames.
• Large ICMP packets — ICMP tunnels data.
• Regular outbound connections on non-standard ports — C2 or exfil.
• HTTP POST to an IP address (not a domain) — likely manual exfil.