When working through these captures it is helpful to start with the endpoints that have the most packets and work your way down. This will show all the endpoints in the capture. Let’s start by looking at some statistics and have Wireshark create a filter for us. The ability to filter out and focus in on conversations in the TCP stream is what we tend to do when looking for evil on the wire. This is, without question, the most powerful part of Wireshark. You can see the filter box at the top of the screen. Now, let’s leave that be for a bit and play with some filters. When you select some hex in the third pane or a section in the second pane it will highlight the corresponding information in the other pane. After all, we are all not Chris Brenton, Bill Stearns, Mike Poor or Judy Novak. The third pane is the raw hex and ASCII decode of the packet and the second pane describes what that hex means. When you select a packet the second and third pane will change. Take a moment and click on any packet in your capture. The top pane is all of the individual packets it has the number of the packet, the time, the source, destination, protocol, length and other information. Then, you open a 2GB network capture in Wireshark, excited to be one of the “leet” few who use this powerful tool and you get this… One of the more powerful techniques for network hunting is sifting through a network capture. In this post, we will be looking at how to identify the connections with the most packets, how to enable DNS resolution in the captures, and how to create a series of basic filters to remove known “good” traffic from the packet capture. Specifically, we want to have a packet capture of the traffic from that system that is leaving your network going out to the Internet. And, let’s say you can get a packet capture from that system. Let’s say you have a system you believe to be compromised.

Wireshark filters for protocol