Network Intrusion Analysis · Topic 3 of 7
Wireshark and PCAP Analysis
Use Wireshark with a PCAP file to follow a TCP stream, extract transferred files, and find the addresses, ports, protocols and payloads in an intrusion.
- 5 min
- A PCAP file is a saved capture of packets.
- Display filters such as
ip.addr == A.B.C.Dnarrow the packets shown. - Conversations and Protocol Hierarchy give an overview of the traffic.
What it is
Wireshark is a packet analyser that opens a PCAP file, which is a saved capture of network traffic, so that an analyst can read what happened.
In an intrusion case, you use it to answer a short list of questions. Who talked to whom, on which ports, with which protocols, and what was sent?
You can also rebuild files that crossed the network, because the packets of a TCP conversation hold the file content in order.
How it works
Filter to find the suspicious conversation, read its elements, then rebuild any file that moved.
Finding the conversation
Wireshark has three panes. The packet list shows one line per packet, the details pane shows the protocol layers of the selected packet, and the bytes pane shows the raw data.
Display filters narrow the packet list. Some useful ones are:
| Filter | Shows |
|---|---|
ip.addr == 10.1.1.25 | Packets to or from that address |
tcp.port == 80 | TCP traffic on port 80 |
http.request.method == "POST" | HTTP requests that send data |
dns | DNS traffic |
tcp.flags.syn == 1 && tcp.flags.ack == 0 | The first packet of new TCP connections |
frame contains "password" | Packets that include that text |
The Statistics menu helps with an overview. Conversations lists each pair of hosts with packet and byte counts, and Protocol Hierarchy shows which protocols make up the traffic. A host with a very large byte count is a good place to start.
Key elements of an intrusion
For each suspicious conversation, note these elements.
| Element | Where to find it | What it tells you |
|---|---|---|
| Source address | IP header | The host that started the traffic |
| Destination address | IP header | The target, or the server contacted |
| Source port | TCP or UDP header | The client side of the connection |
| Destination port | TCP or UDP header | The service, such as 80 for HTTP |
| Protocols | Details pane layers | What application was used |
| Payloads | Bytes pane or Follow stream | What data was sent, such as commands or files |
A typical intrusion might show an external address scanning many ports on a server, then a successful connection to a web service. It might then show a request carrying an attack string, and a new outbound connection from the server to the attacker.
The order and timing matter. Sort by time, and read the story from the first scan to the last connection.
Following a TCP stream
To see one conversation as readable text, right click a packet and choose Follow, then TCP Stream. Wireshark joins the data in order and shows the client side and the server side in different colours.
A web request, a login or a pasted command can be read directly this way. Wireshark also shows the stream number, which you can use as a filter in the form tcp.stream eq 4.
Extracting a file
There are two common ways to extract a file.
- Export Objects. Choose File, then Export Objects, then HTTP. Wireshark lists the files it saw in HTTP traffic, with their names and sizes. Select one and save it. Other protocols, such as SMB and TFTP, appear in the same menu.
- Follow the stream. Follow the TCP stream, set the display to Raw, and use Save as. This gives the data of the stream, and you must remove any headers before the file content if they are included.
After saving the file, take its hash and compare it with threat intelligence or a sandbox report.
$ sha256sum extracted_file.exeDo not open an extracted file on a normal machine. It may be malware, so keep it in an isolated environment.
Encrypted streams cannot be rebuilt in this way. For HTTPS, the capture shows addresses, ports and sizes, but the content is unreadable without the session keys.
The same task from the command line
The command line tool tcpdump can read a saved capture and filter it.
$ tcpdump -nn -r capture.pcap host 10.1.1.25 and port 80What to remember for the exam
Seven facts cover most questions on this topic.
- A PCAP file is a saved capture of packets.
- Display filters such as
ip.addr == A.B.C.Dnarrow the packets shown. - Conversations and Protocol Hierarchy give an overview of the traffic.
- Key elements are source and destination addresses and ports, protocols and payloads.
- Follow TCP Stream shows a whole conversation as text.
- File, Export Objects, HTTP lists and saves files seen in HTTP traffic.
- Encrypted payloads cannot be read or rebuilt without keys.
Start with Statistics, Conversations, find the busiest or oddest pair of hosts, then filter on them.
Common mistakes
These four errors appear often.
Confusing source and destination ports. The destination port usually shows the service, and the source port is a random client port.
Expecting to extract files from HTTPS. The data is encrypted, so only metadata is visible.
Opening extracted files on a normal workstation. They may be malware.
Reading single packets instead of the stream. Follow the stream to see the whole exchange in order.
A capture may hold passwords and personal data, so store it securely and share it only with people who need it.
Check yourself
Work through these three questions.
How can you read a whole TCP conversation in Wireshark?
Right click a packet and choose Follow, then TCP Stream. Wireshark shows the data of the conversation in order.
How do you list and save files that crossed the network in HTTP?
Use File, Export Objects, HTTP, then select a file and save it.
Why can you not rebuild a file from an HTTPS stream in a capture?
The payload is encrypted, so the capture shows only addresses, ports and sizes.
Topic 3 of 7 in Network Intrusion Analysis
Test yourself on Network Intrusion Analysis
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.