Wireshark: Capture Filters and Malicious Traffic Patterns

Wireshark is the world's foremost network protocol analyzer. It lets you see what's happening on your network at a microscopic level.

Getting Started#

1. Select Interface: Choose the network card you want to sniff (e.g., eth0 or wlan0).
2. Start Capture: Click the blue shark fin icon.
3. Stop Capture: Click the red square when you have enough data.

Essential Filters#

Wireshark captures everything. Filters are how you find the needle in the haystack.

• ip.addr == 192.168.1.5: Show traffic to/from this IP.
• tcp.port == 80: Show HTTP traffic.
• http.request.method == "POST": Show only POST requests (useful for finding logins).
• dns: Show DNS queries.

Following Streams#

Right-click a packet -> Follow -> TCP Stream. This reconstructs the entire conversation between client and server in a readable format. It's amazing for seeing exactly what data was transferred.

Use Cases for Hackers#

• Credentials: Finding cleartext passwords (FTP, Telnet, HTTP).
• Malware Analysis: Seeing what a virus does on the network.
• Debugging: Understanding why your exploit isn't working.

Conclusion#

Wireshark is a fundamental tool. Whether you're debugging a connection or hunting for malware, you need to know how to read packets.

Display Filter Cookbook#

Reading a TLS Alert#

A fatal alert after ClientHello usually means a version or cipher mismatch. Alert code 40 is a handshake failure; code 42 is a bad certificate. If your proxy fails here, the pinning or the trust store is the place to look.

Credentials Over Cleartext#

Follow the TCP stream of an FTP or Telnet session. The USER and PASS lines appear in plain text. In a test report, redact the password but keep the session shape: client, server, protocol, and the fact the field was cleartext.

Malware Traffic Tells#

• Periodic small DNS TXT queries with high-entropy subdomains -> possible DNS tunneling.
• Long-lived TLS sessions to rare TLDs at fixed intervals -> beaconing cadence.
• Large outbound transfers at night over nonstandard ports -> check against your change calendar.

Copy code
# Turn a capture into a conversation summary
tshark -r capture.pcap -q -z conv,tcp
# Extract DNS questions
tshark -r capture.pcap -Y 'dns.flags.response == 0' -T fields -e dns.qry.name | sort | uniq -c | sort -rn

tshark is the same engine in batch mode. Keep both a .pcap of the interesting window and the tshark summary in the report appendix.

Capture Filter Basics#

Display filters hide packets; capture filters decide what gets saved. port 443 on capture throws away the rest. On an incident, save everything and filter on display; you cannot reconstruct what you did not capture.

Statistics Views#

• Protocol Hierarchy: what share is TLS vs DNS vs stray ICMP.
• Conversations: which pairs moved the most bytes.
• Endpoints: clean list of hosts seen.
• IO Graph: throughput spikes; a flat periodic line is worth a closer look.

Timeline Sketch#

Plot DNS first. tshark with -Y 'dns' gives timestamps, then HTTP after. The gap between the DNS query and the HTTP request is the target's startup time, not your scan speed.

Expert Infos#

Wireshark flags protocol oddities in the Expert Information panel. Retransmissions, out-of-order, and zero-window events tell you the path quality before you look at payloads. A hunt for malicious traffic starts with clean vs noisy lines.

TLS 1.3 Changes#

With 1.3, the handshake is mostly encrypted after ServerHello. The Certificate is protected, so passive decryption needs the client-side session keys (SSLKEYLOGFILE). Collect keys at the client, and Wireshark decrypts 1.3 traffic too.

Copy code
SSLKEYLOGFILE=keys.log curl https://example.com
# then in Wireshark: Preferences -> Protocols -> TLS -> (Pre)-Master-Secret log file

SMB and Windows Traffic#

Copy code
smb2.cmd == 5   # Create
smb2.filename contains ".exe"

A Create carrying an .exe path on a share is worth the incident ticket. Watch for lateral movement in the same capture: one auth source, many targets.

IO Graph for Beacon Hunting#

A flat, periodic line in the IO Graph stands out against normal web noise. Narrow the filter to the suspect host, export the graph, and attach it to the report.

Saving and Slicing#

• File -> Export Specified Packets to keep the evidence capture.
• Merge related captures with mergecap.
• Slice by time window with editcap -A and -B.

Keep the raw pcap. Every conclusion in the report cites a packet number from it.

Display Filter Math#

Combine filters with boolean logic:

Copy code
http.request and not ip.addr == 10.0.0.5
dns and dns.qry.name contains "update"
tls.handshake.type == 1 and tls.handshake.version < 0x0303

Parentheses matter. ! negates, and/or bind left to right.

Packet Comments#

Add a comment on a packet before exporting slices. The next person reading the pcap sees your note instead of guessing.

Name Resolution#

Edit -> Preferences -> Name Resolution. Turn on reverse DNS lookups, but do not trust the names; cross-check the IPs against your inventory.

Follow Streams and Search Encrypted#

Encrypted streams still carry metadata: SNI in the ClientHello names the target host, and the certificate chain names the issuer. A capture of an encrypted beacon still tells you who the client talked to, even when you cannot read the payload.

Anomaly Checklist#

• Unexpected SYN scans (many SYNs, no ACKs).
• ARP storms and duplicate-MAC responses.
• DNS responses larger than the question (TXT or ANY tunneling).
• Cleartext admin protocols (Telnet, FTP, HTTP with Basic auth).

Save Hygiene#

Keep captures named with date and host. Never leak the raw pcap to a place with broader access than the incident file.

Export as JSON#

Copy code
tshark -r capture.pcap -T json -Y 'dns' > dns.json

JSON makes it easy to feed into a script that flattens the query log into the report.

Incident Workflow#

When a capture lands on your desk:

• Save as-is before filtering anything
• Protocol hierarchy for the overall shape
• Conversations tab for top talkers
• Expert Infos for anomalies
• tshark slice of the suspicious interval
• JSON export of DNS for the log

Reference Tables#

Reminders#

2. confirm before reporting
3. confirm before reporting
4. confirm before reporting
5. confirm before reporting
6. confirm before reporting
7. confirm before reporting
8. confirm before reporting
9. confirm before reporting
10. confirm before reporting
11. confirm before reporting
12. confirm before reporting
13. confirm before reporting
14. confirm before reporting
15. confirm before reporting

Command Cheatsheet#

Copy code
tshark -r cap.pcap -Y 'dns' -T fields -e dns.qry.name
tshark -r cap.pcap -z conv,tcp
mergecap a.pcap b.pcap -w merged.pcap

Final Notes#

2. confirm, document, report
3. confirm, document, report
4. confirm, document, report
5. confirm, document, report
6. confirm, document, report
7. confirm, document, report
8. confirm, document, report
9. confirm, document, report
10. confirm, document, report
11. confirm, document, report
12. confirm, document, report
13. confirm, document, report
14. confirm, document, report
15. confirm, document, report
16. confirm, document, report
17. confirm, document, report
18. confirm, document, report
19. confirm, document, report
20. confirm, document, report
21. confirm, document, report

Short Notes#

2. document the observation, then the conclusion
3. document the observation, then the conclusion
4. document the observation, then the conclusion
5. document the observation, then the conclusion
6. document the observation, then the conclusion
7. document the observation, then the conclusion
8. document the observation, then the conclusion
9. document the observation, then the conclusion
10. document the observation, then the conclusion
11. document the observation, then the conclusion
12. document the observation, then the conclusion
13. document the observation, then the conclusion
14. document the observation, then the conclusion
15. document the observation, then the conclusion
16. document the observation, then the conclusion
17. document the observation, then the conclusion
18. document the observation, then the conclusion
19. document the observation, then the conclusion
20. document the observation, then the conclusion
21. document the observation, then the conclusion
22. document the observation, then the conclusion
23. document the observation, then the conclusion

Incident Quick View#

Save the matching pcap slice next to the report page.

Closing Notes#

1. Verify each observation with a second independent check.
2. Prefer packet, request/response, or log evidence over prose.
3. Tie the finding to the control that should have caught it.
4. Redact secrets but keep the request shape visible.
5. Never quote a payload you have not actually tested.
6. Keep one repro per file; name it clearly.
7. Update the matrix when a new tool or a new gadget appears.
8. Shorten CI runs; the tool should fit in a normal deploy.
9. Confirm a false positive before you report it.
10. A finding without evidence is folklore.
11. Document the exact time delta or row count.
12. Record the binary version or framework version in the report.
13. Every tool output in the report ties to a command.
14. The evidence tree should let a second reader replay the finding.
15. Log the encoding and the raw bytes with the finding.
16. If a fix closes one probe, re-run the others to be sure.
17. Closing one instance rarely closes the class.
18. Rotate pretexts and rate limits so the test keeps signal.
19. Track report rate, not click rate, for awareness campaigns.
20. Keep capture files short; slice the interesting window.
21. ZAP baselines belong in CI, full scans on staging.
22. Burst the auth endpoint, then verify no lockout.
23. Diff lockfiles before running a supply-chain claim.
24. Parameter pollution hides in headers and cookies too.
25. Checksum your dependencies and rotate keys on a schedule.
26. Time-based blind is slow; always pair it with a boolean check.
27. Show the GRANTS output; it proves reachability limits.
28. DOM sinks are data-flow endpoints, not just payload targets.
29. Trusted Types and CSP sit on the same defense line.
30. Stash the tshark JSON slice with the pcap for reference.
31. A short pcap with notes beats a ten-minute capture.
32. Name files with date, host, and window.
33. A flat periodic line in the IO graph is a beacon candidate.
34. Spike bursts in Burp are usually manual, not scanner.
35. Tune Nuclei rate limits so the range is not blocked.
36. sqlmap risk/level flags widen the payload classes.
37. Arjun finds parameters that do not appear in the URL.
38. Keep WordPress plugin nonces in a separate test case.
39. XML-RPC is the slow, quiet way in. Disable it if unused.
40. Backup files in the docroot are findings by themselves.
41. Upload extension checks should run on the normalized name.
42. Homoglyphs hide inside scope lists and allowlists.
43. Normalize at the edge, log raw, never filter before decode.
44. UTF-7 and legacy codecs keep bypassing naive filters.
45. A fullwidth probe that passes is a bug in the pipeline.
46. Rotate keys, pin versions, and rotate them again after a patch.
47. Prototype pollution turns one key into a global change.
48. __proto__ is the first key to block; check constructor too.
49. Run npm ls deep; the vulnerable path is rarely the top level.
50. Refuse constructor.prototype keys at every merge point.
51. Freeze Object.prototype for the server if you must merge.