{"id":1688,"date":"2015-11-25T04:00:36","date_gmt":"2015-11-25T04:00:36","guid":{"rendered":"https:\/\/www.hackmethod.com\/?p=1688"},"modified":"2015-12-06T03:39:43","modified_gmt":"2015-12-06T03:39:43","slug":"malicious-network-traffic-wireshark","status":"publish","type":"post","link":"https:\/\/hackmethod.com\/malicious-network-traffic-wireshark\/","title":{"rendered":"Malicious Network Traffic Analysis with Wireshark"},"content":{"rendered":"

Overview – Wireshark Workflow<\/h4>\n

This is an example of my workflow for examining malicious network traffic. \u00a0The traffic I’ve chosen is traffic from The Honeynet Project<\/a>\u00a0and is one of their challenges captures. \u00a0For small pcaps I like to use Wireshark just because its easier to use. Sometimes I’ll pull apart large a pcap, grab the TCP stream I want and look at it in Wireshark.<\/p>\n

What you use to look at traffic largely depends on what’s going on. You could run it through snort, bro or SiLK if you wanted and if this pcap was large, that’s exactly what I would do. This pcap has 348 packets, The Honeynet Project has already carved it out of a much larger pcap for us.<\/p>\n

First, my setup, I’m doing this in a Kali 2.0 VM (Virtual Machine) with my network card disabled. \u00a0I do this because in the event I’m analyzing something or carve a binary out of the traffic I want to make sure my host operating system does not get infected.<\/p>\n

The Challenge:<\/strong>
\nA network trace with attack data is provided. (Note that the IP address of the victim has been changed to hide the true location.) Analyze and answer the following questions:<\/p>\n