Network Forensics with Wireshark

Network forensics analyzes captured packet data (PCAP files) to reconstruct network-level attacker activity: lateral movement, C2 communication, credential theft, data exfiltration, and protocol anomalies invisible in host-based forensics.

Collect network evidence with Wireshark (interactive), tcpdump (CLI), or dedicated network taps. Deploy span ports or network taps on critical segments before incidents occur. Retrospective analysis requires pre-existing capture infrastructure.

Display filters narrow analysis: http shows HTTP, tcp.port==443 for HTTPS, ip.addr==10.0.0.5 for a specific host, dns for name queries, tcp.flags.syn==1 && tcp.flags.ack==0 for SYN-only packets (port scan detection).

Right-click a packet → Follow → TCP Stream to reconstruct the full conversation in human-readable form. For HTTP, this shows complete request and response bodies — useful for reconstructing exfiltrated data or C2 commands.

C2 beaconing appears as regular, periodic connections to the same external IP. Apply ip.dst == [suspicious_ip] and check frame timing — consistent intervals (every 60, 300, or 600 seconds) with small data volumes is characteristic of beacon behavior.

DNS queries reveal C2 domains, domain generation algorithm (DGA) patterns, and DNS tunneling. High-entropy domain names (e.g., a1b2c3d4e5f6.evil.com), unusual TXT record queries, and unusually large DNS responses indicate DNS-based C2 or data exfiltration.

Cleartext protocols (HTTP, FTP, SMTP, LDAP, Telnet) transmit credentials in plaintext visible in packet captures. Filter with http contains "password" or ftp contains "PASS" to identify credential exposure during the incident window.

Encrypted TLS traffic cannot be decrypted without private keys or pre-master secrets. However: JA3 fingerprints identify TLS client libraries (malware has characteristic JA3 hashes), certificate Subject Alternative Names reveal C2 infrastructure, and traffic timing remains visible.

Exfiltration indicators: large outbound data transfers to unusual destinations, HTTP POST requests with base64-encoded bodies, unusually large DNS responses (DNS tunneling), ICMP packets with large payloads, and outbound traffic during non-business hours.

NetworkMiner passively reconstructs transferred files from PCAPs — images, documents, executables transferred over HTTP or SMB appear as extractable files. It also extracts credentials, certificates, and messages from captured traffic automatically.

Extract timestamps of key network events: first connection to C2, credential transmission, lateral movement (authentication attempts to internal hosts), and data staging/exfiltration. These network timestamps correlate with host-based artifacts to build the complete incident timeline.

What Wireshark display filter would show only HTTP traffic?

Network forensics with Wireshark reconstructs attacker network activity from PCAP evidence. C2 beaconing detection, DNS analysis for tunneling, credential theft in cleartext protocols, TLS JA3 fingerprinting, and data exfiltration pattern recognition collectively reveal network-layer attack evidence.