Lesson 5.11: Packet analysis: finding what a device is really doing
What a packet capture is, how tcpdump and Wireshark show it, capture and display filters, and how analysts find the interesting few packets in thousands: top talkers, DNS queries, timing and payloads. In the lab you analyse ten minutes of office traffic, find which machine talks the most and to whom, notice a domain looked up once a minute, prove the connections come at exact intervals and read the request that gives the malware away.
19 min
You will learn to
- Explain packet captures, tcpdump and Wireshark
- Use filters to narrow a capture
- Find top talkers and unusual DNS queries
- Recognise beaconing by its timing
- Read payloads to confirm a finding
Key terms
- Packet capture (pcap)
- A recording of the packets that passed a network interface, with their headers and often their contents.
- tcpdump and Wireshark
- tcpdump captures and prints packets on the command line; Wireshark does the same with a graphical interface and decodes hundreds of protocols.
- Capture and display filters
- Rules that keep only matching packets, either while capturing or when viewing.
- Top talkers
- The hosts that send or receive the most traffic; a quick first view of a capture.
- Beaconing
- Regular, automatic check-ins from an infected machine to its command-and-control server, recognisable by their steady timing.
- Command and control (C2)
- The server an attacker uses to send instructions to infected machines and receive their data.
← File and directory permissions · All lessons · Permission, scope and rules of engagement →