July 10, 202612 min read

Network Forensics and PCAP Analysis: Finding the Attack in the Packet Capture

Sources:Wireshark Documentation|SANS Network Forensics Cheat Sheet|SecurityOnion Network Security Monitoring

Eric Bang

Founder & Cybersecurity Evangelist

40%

of incident investigations reveal C2 or exfiltration activity in PCAP that was not captured by endpoint or SIEM logs

Wireshark

the de facto standard for PCAP analysis — open source, cross-platform, and the tool used in over 90% of network forensics workflows

tshark

Wireshark's command-line counterpart — essential for processing large PCAP files (>1GB) where the GUI becomes impractical

Full packet capture

NetworkMiner, Zeek (Bro), and Suricata convert raw PCAP to structured logs automatically — reducing manual analysis time by 60-70% for large captures

Capturing traffic: where and how

Before analysis, you need the PCAP file. The capture point determines what traffic is visible.

Capturing at the network perimeter (firewall/edge)

PCAP at the perimeter captures all traffic entering and leaving the network — the best vantage point for detecting C2 communications, data exfiltration, and external scanning. Configure port mirroring on your edge firewall or core switch to send all traffic to a capture device (a Security Onion node, a network tap, or a dedicated capture server running tcpdump). At enterprise scale, capturing all perimeter traffic requires significant storage — typically filter to capture-on-rule-match mode where specific protocol triggers initiate capture.

Capturing on an endpoint with Wireshark

For targeted capture on a specific suspected host: Wireshark installed on the endpoint (with admin rights) can capture all traffic from that host's network interface in real time. This is appropriate during an active incident when you want to observe what a specific machine is doing right now. Limitation: encrypted traffic shows IP/port metadata but not content. For malware that uses TLS for C2, you still see connection patterns, volumes, and timing — all forensically useful even without decryption.

Capturing retroactively from existing network monitoring infrastructure

Security Onion, Zeek/Bro, and NDR platforms (Darktrace, ExtraHop, Vectra) passively record network metadata and often full-packet data on rolling buffers. During an incident, query these platforms for the affected IP ranges and time windows first — you may already have the PCAP without a new capture deployment. Ask: does our network security monitoring platform have full-packet retention, and if so, what is the retention window?

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Wireshark: the essential filters for incident response

Wireshark's display filter language is the core skill for PCAP analysis. These filters address the most common incident response scenarios.

Filter to a specific host or conversation

ip.addr == 10.1.2.3 — all traffic to or from a specific IP. ip.src == 10.1.2.3 and ip.dst == 8.8.8.8 — specific source to destination. tcp.stream eq 15 — follow a specific TCP conversation identified by stream index. Right-click any packet > Follow > TCP Stream is the fastest way to read the full content of a session including HTTP requests, form submissions, and any cleartext credentials.

Filter for suspicious protocol use

dns — all DNS traffic (look for DGA-pattern domains, unusually high DNS query volumes to a single domain, DNS TXT record queries used for C2). http.request.method == POST — all HTTP POST requests (data being sent from client to server — look for large POSTs to unusual external IPs that indicate exfiltration). ftp or telnet — cleartext protocol use that should not exist in modern environments and almost always indicates either legacy systems or an attacker using these protocols deliberately. smtp — email traffic (outbound email exfiltration or spam relay).

Detect high-volume exfiltration

Statistics > Conversations > Sort by Bytes (descending). Large data transfers from internal IPs to external destinations appear at the top. A 500MB conversation from a workstation to an external IP over an unusual port or protocol is an exfiltration signal. Also: Statistics > Endpoints shows total bytes per IP — an endpoint sending 10x more data than typical warrants investigation. This statistical view surfaces anomalies faster than packet-by-packet analysis.

Identify C2 beacon patterns

C2 malware communicates with its controller at regular intervals (beaconing) — typically every 30-300 seconds. In Wireshark: filter to a suspected C2 IP, view the packet list, and look for regular-interval packets. Statistics > IO Graph with a delta filter shows communication timing patterns. A consistent 60-second interval of outbound packets to a single external IP is a strong C2 beacon indicator. Also: look for HTTP connections with unusual User-Agent strings, small packet sizes (C2 check-in), and consistent connection timing.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Free daily briefing

Briefings like this, every morning before 9am.

Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.

tshark: command-line PCAP analysis for large files

Wireshark's GUI becomes impractical for PCAP files above 1-2GB. tshark (Wireshark's command-line interface) processes large captures efficiently and supports pipe-based workflows.

Extract DNS queries from a large capture

tshark -r capture.pcap -Y dns -T fields -e dns.qry.name | sort | uniq -c | sort -rn | head 50 — extracts all DNS queries, sorts by frequency, shows top 50 domains queried. DGA domain patterns (random-looking strings) and unusual TLD use (domains ending in .ru, .cn, .pw queried from corporate hosts) appear clearly in this output. Process a 10GB PCAP in minutes.

Extract all HTTP connections with destination and size

tshark -r capture.pcap -Y http.request -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri -e http.content_length — tabular output of every HTTP request: source IP, destination IP, host header, URI, and content size. Pipe to grep to filter for specific hosts or URI patterns. Sort by content_length to identify large data transfers.

Identify all unique external IPs a host communicated with

tshark -r capture.pcap -Y 'ip.src == 10.1.2.3' -T fields -e ip.dst | sort -u — all unique destination IPs from a specific source. Cross-reference the output against your threat intelligence feeds: grep -F -f malicious_ips.txt from the tshark output identifies any connections to known-malicious infrastructure in the capture.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Zeek (Bro): automatic PCAP-to-log conversion

Zeek is an open source network analysis framework that processes PCAP files and produces structured logs — conn.log (all connections), dns.log, http.log, ssl.log, files.log, and others — that are far easier to query than raw PCAP. Installing Zeek and running it against a PCAP file reduces analysis time dramatically.

Process a PCAP with Zeek

zeek -r capture.pcap — processes the PCAP and outputs structured log files in the current directory. conn.log contains every connection with src/dst IP, ports, bytes, duration, and state. dns.log extracts all DNS queries and responses. files.log extracts metadata for all files transferred over HTTP/FTP including hashes — allowing you to identify transferred malware or exfiltrated documents by hash without manual extraction.

Query Zeek logs for exfiltration signals

cat conn.log | zeek-cut id.orig_h id.resp_h orig_bytes | sort -k3 -rn | head 20 — lists connections by bytes sent from origin to responder (outbound data volume), sorted by largest first. Exfiltration events appear as very large orig_bytes values to external destination IPs. This is faster than the Wireshark Statistics view for large captures.

JA3/JA3S TLS fingerprinting for encrypted C2

Zeek's ssl.log includes JA3 and JA3S fingerprints — MD5 hashes derived from TLS ClientHello and ServerHello fields. These fingerprints identify the TLS client implementation being used. Malware families often have distinctive JA3 fingerprints — known-malicious JA3s are published by Salesforce and other researchers. grep the JA3 values from your ssl.log against published malicious JA3 feeds to identify encrypted C2 sessions without decryption.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

The bottom line

PCAP analysis answers the questions that endpoint and SIEM logs cannot: what data left the network, how the attacker communicated with C2, and what the lateral movement path looked like at the network level. Wireshark's display filters and conversation statistics handle most triage use cases in minutes. tshark and Zeek handle large captures efficiently without requiring the full GUI. For organizations that do not currently capture network traffic, a Security Onion deployment on the perimeter or a cloud-based NDR sensor is the infrastructure investment that makes PCAP analysis available retroactively during the next incident.

Frequently asked questions

How much storage does full packet capture require?

Full-packet capture volume depends on network throughput. At 1 Gbps sustained traffic, full capture generates approximately 450GB per hour. Enterprise networks typically sustain 2-10% of peak bandwidth during normal hours. Practical storage for a 1 Gbps perimeter with 10% average utilization and 30-day retention is approximately 30-40TB. Most organizations implement capture on trigger (capture only when specific signatures fire) or metadata-only (Zeek logs without raw packets) rather than full-packet indefinite retention. 7-day full-packet retention with 90-day metadata retention is a common operational balance.

Can you see encrypted HTTPS traffic in Wireshark?

Without the server's private key or a TLS session key log file, Wireshark cannot decrypt TLS traffic. What you can see: source and destination IPs and ports, TLS handshake metadata (Server Name Indication field reveals the domain even in encrypted traffic, JA3/JA3S fingerprints identify the TLS implementation), packet sizes and timing (beacon pattern detection works on encrypted traffic), and certificate details (the server's certificate is transmitted unencrypted). For incident response, SSL inspection at a proxy or the server's private key are required for content decryption.

What is the difference between Zeek, Suricata, and Snort for network analysis?

Zeek (formerly Bro) is a network analysis framework that produces structured logs from PCAP — focused on network metadata and protocol analysis, not signature detection. Suricata and Snort are signature-based IDS/IPS engines — they alert on traffic that matches known attack signatures. For incident response PCAP analysis, Zeek is typically more useful because it produces queryable logs for all connections and protocols rather than only alerting on signature matches. In production deployment, run both: Zeek for metadata and protocol analysis, Suricata for signature-based alerting.

Sources & references

Free resources

Free download

Critical CVE Reference Card 2025–2026

25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.

Free download

Ransomware Incident Response Playbook

Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.

Free newsletter

Get threat intel before your inbox does.

50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.

Unsubscribe anytime. We never sell your data.

Author

Eric BangCISSP

Founder & Cybersecurity Evangelist, Decryption Digest

Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.

View profile →LinkedIn

Back to all briefings

Subscribe for Updates

network forensics PCAP analysis Wireshark incident response packet capture security network forensics IR C2 network detection PCAP tshark network analysis data exfiltration detection PCAP

Black Hat Giveaway

Win a $2,495 Black Hat pass.

Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.

Network Forensics and PCAP Analysis: Finding the Attack in the Packet Capture

Capturing traffic: where and how

Wireshark: the essential filters for incident response

tshark: command-line PCAP analysis for large files

Zeek (Bro): automatic PCAP-to-log conversion

The bottom line

Frequently asked questions

How much storage does full packet capture require?

Can you see encrypted HTTPS traffic in Wireshark?

What is the difference between Zeek, Suricata, and Snort for network analysis?

Sources & references

Critical CVE Reference Card 2025–2026

Ransomware Incident Response Playbook

Get threat intel before your inbox does.

Subscribe to enter the giveaway