Skip to main content
cd ..

Network Traffic Analysis: Detecting Intrusions with Wireshark

12 min read
Network Traffic Analysis: Detecting Intrusions with Wireshark

The Art of Packet Analysis

Packets don’t lie. When an intrusion occurs, the network traffic leaves a trace. Wireshark is the de facto tool for analyzing these traces.

Key Indicators of Compromise (IoCs)

What are we looking for?

  • Unusual Ports: High-number ports communicating with external IPs.
  • Beaconing: Regular, heartbeat-like connections indicating C2 communication.
  • Data Exfiltration: Large outbound transfers at odd hours.

Analyzing a Sample Attack

We will walk through a PCAP file containing a real-world malware infection trail.

Step 1: Filtering Noise

!(arp or dns or icmp)

Step 2: Following Streams

Reconstructing the TCP stream to see exactly what data was transferred.

Conclusion

Network analysis is a critical skill for Blue Teamers. Wireshark gives you the visibility needed to defend your perimeter.