Analyzing Network Traffic for Incidents When to Use - SIEM alerts on anomalous network traffic patterns requiring deeper investigation - C2 beaconing is suspected and needs confirmation through packet-level analysis - Data exfiltration volume or destination must be quantified from network evidence - Lateral movement between systems needs to be traced through network connections - An IDS/IPS alert requires packet-level validation to confirm or dismiss Do not use for host-based forensic analysis (process execution, file system artifacts); use endpoint forensics tools instead. Prerequisites - Fu…

\\t' -k5 -rn\n\n# DNS tunneling detection (high volume of TXT queries)\ncat dns.log | zeek-cut query qtype | grep TXT | cut -f1 \\\n | rev | cut -d. -f1,2 | rev | sort | uniq -c | sort -rn | head\n\n# Unusual protocol usage (ICMP tunneling, DNS over HTTPS)\ncat conn.log | zeek-cut proto id.resp_p orig_bytes | awk '$1 == \"icmp\" && $3 > 1000'\n```\n\n**Wireshark Exfiltration Filters:**\n```\n# Large HTTP POST uploads\nhttp.request.method == \"POST\" && tcp.len > 10000\n\n# FTP data transfers\nftp-data && ip.src == 10.0.0.0/8\n\n# DNS with large TXT responses (tunneling)\ndns.resp.type == 16 && dns.resp.len > 200\n```\n\n### Step 5: Extract and Correlate IOCs\n\nPull network-based indicators from traffic analysis:\n\n- External IP addresses contacted by compromised hosts\n- Domains resolved via DNS during the incident timeframe\n- URLs accessed via HTTP/HTTPS (if SSL inspection is in place)\n- TLS certificate details (subject, issuer, serial number, JA3/JA3S hashes)\n- User-Agent strings from HTTP requests\n- File transfers captured in PCAP (extract using Wireshark Export Objects)\n\n### Step 6: Document Network Forensic Findings\n\nCompile analysis into a structured report with evidence references:\n\n- Reference specific PCAP files, frame numbers, and timestamps for each finding\n- Include packet captures of key evidence as screenshots or exported PDFs\n- Map network activity to the incident timeline\n- Correlate network findings with host-based evidence from endpoint forensics\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **PCAP (Packet Capture)** | File format storing raw network packets captured from a network interface for offline analysis |\n| **Beaconing** | Regular, periodic network connections from a compromised host to a C2 server, identifiable by consistent timing intervals |\n| **JA3/JA3S** | TLS client and server fingerprinting method based on the ClientHello and ServerHello parameters; unique per application |\n| **NetFlow/IPFIX** | Network traffic metadata (source, destination, ports, bytes, duration) collected by routers and switches without full packet capture |\n| **DNS Tunneling** | Technique encoding data in DNS queries and responses to exfiltrate data or maintain C2 through DNS protocol |\n| **Network Tap** | Hardware device that creates an exact copy of network traffic for monitoring without impacting network performance |\n| **Zeek Logs** | Structured metadata logs generated by the Zeek network analysis framework covering connections, DNS, HTTP, SSL, and more |\n\n## Tools & Systems\n\n- **Wireshark**: Open-source packet analyzer for deep inspection of network protocols at the packet level\n- **Zeek (formerly Bro)**: Network analysis framework generating structured metadata logs from live or captured traffic\n- **Arkime (formerly Moloch)**: Open-source full packet capture and search platform for large-scale network forensics\n- **NetworkMiner**: Network forensic analysis tool for extracting files, images, and credentials from PCAP files\n- **RITA (Real Intelligence Threat Analytics)**: Open-source beacon detection and DNS tunneling analysis tool for Zeek logs\n\n## Common Scenarios\n\n### Scenario: Confirming C2 Beaconing and Quantifying Exfiltration\n\n**Context**: EDR detects a suspicious process on a workstation but cannot determine the volume of data exfiltrated. Network team provides PCAP from the full packet capture appliance covering the incident timeframe.\n\n**Approach**:\n1. Filter PCAP to traffic from the compromised host IP to external destinations\n2. Identify the C2 channel by analyzing connection timing patterns (beacon detection)\n3. Extract TLS certificate and JA3 hash from the C2 connection for IOC generation\n4. Calculate total bytes transferred to C2 infrastructure over the incident duration\n5. Check for additional exfiltration channels (DNS tunneling, cloud storage uploads)\n6. Extract any unencrypted files transferred using Wireshark Export Objects feature\n\n**Pitfalls**:\n- Analyzing only HTTP traffic when C2 is operating over HTTPS without SSL inspection\n- Missing DNS tunneling because the data volume per query is small (but total over time is significant)\n- Not correlating network timestamps with endpoint timestamps (timezone mismatches)\n- Overlooking legitimate cloud services abused for exfiltration (OneDrive, Google Drive, Dropbox)\n\n## Output Format\n\n```\nNETWORK TRAFFIC ANALYSIS REPORT\n=================================\nIncident: INC-2025-1547\nAnalyst: [Name]\nCapture Source: Arkime full packet capture\nAnalysis Period: 2025-11-15 14:00 UTC - 2025-11-15 18:00 UTC\nTotal PCAP Size: 4.7 GB\n\nC2 COMMUNICATIONS\nSource: 10.1.5.42 (WKSTN-042)\nDestination: 185.220.101.42:443 (HTTPS)\nBeacon Interval: 60 seconds ± 12% jitter\nSessions: 237 connections over 4 hours\nJA3 Hash: a0e9f5d64349fb13191bc781f81f42e1\nTLS Certificate: CN=update.evil[.]com (self-signed)\nTotal Data Sent: 147 MB (outbound)\nTotal Data Recv: 2.3 MB (inbound - commands)\n\nLATERAL MOVEMENT\n10.1.5.42 → 10.1.10.15 (SMB, TCP 445) - 14:35 UTC\n10.1.5.42 → 10.1.10.20 (RDP, TCP 3389) - 14:42 UTC\n10.1.5.42 → 10.1.1.5 (LDAP, TCP 389) - 15:10 UTC\n\nEXFILTRATION SUMMARY\nProtocol: HTTPS to C2 server\nVolume: 147 MB outbound\nDuration: 14:23 UTC - 18:00 UTC\nFiles Extracted: [list if recoverable from unencrypted channels]\n\nDNS ANALYSIS\nSuspicious Queries: 0 DNS tunneling indicators\nDGA Detection: 0 algorithmically generated domains\n\nEVIDENCE REFERENCES\nPCAP File: INC-2025-1547_capture.pcap (SHA-256: ...)\nZeek Logs: /logs/zeek/2025-11-15/ (conn.log, ssl.log, dns.log)\n```\n---","attachment_filenames":["references/api-reference.md","scripts/agent.py"],"attachments":[{"filename":"references/api-reference.md","content":"# API Reference: Network Traffic Incident Analysis\n\n## tshark - CLI Wireshark\n\n### Basic Syntax\n```bash\ntshark -r \u003cpcap_file> [options]\n```\n\n### Display Filters\n```bash\ntshark -r capture.pcap -Y \"ip.addr==10.0.0.5\"\ntshark -r capture.pcap -Y \"tcp.port==445\" # SMB\ntshark -r capture.pcap -Y \"http.request\" # HTTP requests\ntshark -r capture.pcap -Y \"dns.qr==0\" # DNS queries\ntshark -r capture.pcap -Y \"tcp.flags.syn==1 && tcp.flags.ack==0\" # SYN only\n```\n\n### Field Extraction\n```bash\ntshark -r capture.pcap -T fields -e ip.src -e ip.dst -e tcp.dstport \\\n -Y \"tcp.flags.syn==1\"\n```\n\n### Statistics\n```bash\ntshark -r capture.pcap -q -z conv,ip # IP conversations\ntshark -r capture.pcap -q -z endpoints,ip # IP endpoints\ntshark -r capture.pcap -q -z io,stat,60 # I/O stats per minute\ntshark -r capture.pcap -q -z http,tree # HTTP request tree\ntshark -r capture.pcap -q -z dns,tree # DNS query tree\n```\n\n### Object Export\n```bash\ntshark -r capture.pcap --export-objects \"http,/tmp/http_objects\"\ntshark -r capture.pcap --export-objects \"smb,/tmp/smb_objects\"\n```\n\n## Zeek - Network Security Monitor\n\n### PCAP Analysis\n```bash\nzeek -r capture.pcap\nzeek -r capture.pcap local # With local policy scripts\n```\n\n### Output Logs\n| Log File | Content |\n|----------|---------|\n| `conn.log` | TCP/UDP/ICMP connections |\n| `dns.log` | DNS queries and responses |\n| `http.log` | HTTP requests |\n| `ssl.log` | TLS/SSL handshakes |\n| `files.log` | File transfers |\n| `notice.log` | Security notices |\n\n### Zeek-Cut Field Extraction\n```bash\ncat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p proto service\ncat dns.log | zeek-cut query qtype_name answers\ncat http.log | zeek-cut host uri method user_agent\n```\n\n## Suricata - IDS/IPS\n\n### PCAP Analysis\n```bash\nsuricata -r capture.pcap -l /tmp/output -k none\nsuricata -r capture.pcap -S custom.rules -l /tmp/output\n```\n\n### Output Files\n| File | Content |\n|------|---------|\n| `fast.log` | One-line alert format |\n| `eve.json` | JSON event log (detailed) |\n| `stats.log` | Engine performance statistics |\n\n## Lateral Movement Ports\n\n| Port | Service | Significance |\n|------|---------|-------------|\n| 445 | SMB | File shares, PsExec, WMI |\n| 3389 | RDP | Remote Desktop |\n| 5985/5986 | WinRM | PowerShell Remoting |\n| 22 | SSH | Secure Shell |\n| 135 | RPC | DCOM, WMI |\n| 139 | NetBIOS | Legacy file sharing |\n\n## Scapy - Packet Analysis (Python)\n\n### PCAP Reading\n```python\nfrom scapy.all import rdpcap, IP, TCP\npackets = rdpcap(\"capture.pcap\")\nfor pkt in packets:\n if IP in pkt and TCP in pkt:\n print(pkt[IP].src, pkt[TCP].dport)\n```\n\n## NetworkMiner - Artifact Extraction\n\n### Syntax\n```bash\nNetworkMiner --inputfile capture.pcap --outputdir /tmp/artifacts\n```\nExtracts: files, images, credentials, sessions, DNS, parameters\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":2825,"content_sha256":"7cd9a7e04c4ab3048575bb43896dfb8338e34c1954e27d307402fa5ef8fc379d"},{"filename":"scripts/agent.py","content":"#!/usr/bin/env python3\n\"\"\"Network traffic incident analysis agent using scapy and tshark for PCAP investigation.\"\"\"\n\nimport subprocess\nimport os\nimport sys\nimport json\nimport statistics\nfrom collections import defaultdict\n\ntry:\n from scapy.all import rdpcap, IP, TCP, DNS\n HAS_SCAPY = True\nexcept ImportError:\n HAS_SCAPY = False\n\n\ndef run_tshark(pcap_path, display_filter, fields):\n \"\"\"Run tshark with a display filter and extract specific fields.\"\"\"\n cmd = [\"tshark\", \"-r\", pcap_path, \"-Y\", display_filter, \"-T\", \"fields\"]\n for f in fields:\n cmd += [\"-e\", f]\n cmd += [\"-E\", \"separator=|\"]\n result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)\n rows = []\n if result.returncode == 0:\n for line in result.stdout.strip().splitlines():\n parts = line.split(\"|\")\n if len(parts) == len(fields):\n rows.append(dict(zip(fields, parts)))\n return rows\n\n\ndef get_pcap_summary(pcap_path):\n \"\"\"Get high-level PCAP statistics.\"\"\"\n cmd = [\"tshark\", \"-r\", pcap_path, \"-q\", \"-z\", \"conv,ip\"]\n result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)\n return result.stdout if result.returncode == 0 else \"\"\n\n\ndef detect_lateral_movement(pcap_path):\n \"\"\"Detect potential lateral movement patterns (SMB, RDP, WinRM, SSH).\"\"\"\n lateral_ports = {\"445\": \"SMB\", \"3389\": \"RDP\", \"5985\": \"WinRM\", \"5986\": \"WinRM-S\",\n \"22\": \"SSH\", \"135\": \"RPC\", \"139\": \"NetBIOS\"}\n connections = run_tshark(pcap_path, \"tcp.flags.syn==1 && tcp.flags.ack==0\",\n [\"ip.src\", \"ip.dst\", \"tcp.dstport\"])\n lateral = []\n for conn in connections:\n port = conn.get(\"tcp.dstport\", \"\")\n if port in lateral_ports:\n lateral.append({\n \"src\": conn[\"ip.src\"],\n \"dst\": conn[\"ip.dst\"],\n \"port\": port,\n \"service\": lateral_ports[port],\n })\n return lateral\n\n\ndef detect_data_exfiltration(pcap_path, threshold_mb=10):\n \"\"\"Detect potential data exfiltration based on outbound data volume.\"\"\"\n cmd = [\"tshark\", \"-r\", pcap_path, \"-q\", \"-z\", \"conv,ip\"]\n result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)\n suspects = []\n if result.returncode == 0:\n for line in result.stdout.splitlines():\n parts = line.split()\n if len(parts) >= 8 and \"\u003c->\" in line:\n try:\n ip_a = parts[0]\n ip_b = parts[2]\n bytes_a_to_b = int(parts[4]) if parts[4].isdigit() else 0\n bytes_b_to_a = int(parts[7]) if len(parts) > 7 and parts[7].isdigit() else 0\n total_bytes = bytes_a_to_b + bytes_b_to_a\n if total_bytes > threshold_mb * 1024 * 1024:\n suspects.append({\n \"ip_a\": ip_a,\n \"ip_b\": ip_b,\n \"bytes_a_to_b\": bytes_a_to_b,\n \"bytes_b_to_a\": bytes_b_to_a,\n \"total_mb\": round(total_bytes / (1024 * 1024), 2),\n })\n except (ValueError, IndexError):\n continue\n return suspects\n\n\ndef detect_beaconing(pcap_path, min_conns=10):\n \"\"\"Detect periodic beaconing patterns from TCP connections.\"\"\"\n if not HAS_SCAPY:\n return []\n packets = rdpcap(pcap_path)\n conn_times = defaultdict(list)\n for pkt in packets:\n if IP in pkt and TCP in pkt and (pkt[TCP].flags & 0x02):\n key = f\"{pkt[IP].src}->{pkt[IP].dst}:{pkt[TCP].dport}\"\n conn_times[key].append(float(pkt.time))\n beacons = []\n for key, times in conn_times.items():\n if len(times) \u003c min_conns:\n continue\n intervals = [times[i+1] - times[i] for i in range(len(times)-1)]\n avg = statistics.mean(intervals)\n std = statistics.stdev(intervals) if len(intervals) > 1 else 0\n jitter = (std / avg * 100) if avg > 0 else 0\n if 5 \u003c avg \u003c 7200 and jitter \u003c 30:\n beacons.append({\n \"flow\": key,\n \"connections\": len(times),\n \"avg_interval\": round(avg, 1),\n \"jitter_pct\": round(jitter, 1),\n })\n return beacons\n\n\ndef extract_dns_queries(pcap_path):\n \"\"\"Extract DNS queries and identify suspicious patterns.\"\"\"\n queries = run_tshark(pcap_path, \"dns.qr==0\",\n [\"ip.src\", \"dns.qry.name\", \"dns.qry.type\"])\n return queries\n\n\ndef detect_ids_alerts(pcap_path):\n \"\"\"Run Suricata on the PCAP and extract alerts.\"\"\"\n import tempfile\n suricata_output = os.environ.get(\"SURICATA_OUTPUT_DIR\", os.path.join(tempfile.gettempdir(), \"suricata_output\"))\n os.makedirs(suricata_output, exist_ok=True)\n cmd = [\"suricata\", \"-r\", pcap_path, \"-l\", suricata_output, \"-k\", \"none\"]\n subprocess.run(cmd, capture_output=True, timeout=120)\n alerts = []\n alert_file = os.path.join(suricata_output, \"fast.log\")\n if os.path.exists(alert_file):\n with open(alert_file, \"r\") as f:\n for line in f:\n alerts.append(line.strip())\n return alerts\n\n\ndef extract_http_objects(pcap_path, output_dir):\n \"\"\"Extract HTTP objects (files) from the PCAP.\"\"\"\n os.makedirs(output_dir, exist_ok=True)\n cmd = [\"tshark\", \"-r\", pcap_path, \"--export-objects\", f\"http,{output_dir}\"]\n subprocess.run(cmd, capture_output=True, timeout=60)\n exported = []\n if os.path.exists(output_dir):\n for f in os.listdir(output_dir):\n filepath = os.path.join(output_dir, f)\n exported.append({\"filename\": f, \"size\": os.path.getsize(filepath)})\n return exported\n\n\ndef generate_incident_report(pcap_path, beacons, lateral, exfil, dns_queries):\n \"\"\"Generate a network incident analysis report.\"\"\"\n report = {\n \"pcap\": pcap_path,\n \"pcap_size_mb\": round(os.path.getsize(pcap_path) / (1024*1024), 1),\n \"findings\": {\n \"beacons_detected\": len(beacons),\n \"lateral_movement_flows\": len(lateral),\n \"exfiltration_suspects\": len(exfil),\n \"dns_queries\": len(dns_queries),\n },\n \"beacons\": beacons,\n \"lateral_movement\": lateral[:10],\n \"exfiltration\": exfil,\n }\n return report\n\n\nif __name__ == \"__main__\":\n print(\"=\" * 60)\n print(\"Network Traffic Incident Analysis Agent\")\n print(\"Beaconing, lateral movement, exfiltration detection\")\n print(\"=\" * 60)\n\n pcap = sys.argv[1] if len(sys.argv) > 1 else None\n\n if pcap and os.path.exists(pcap):\n print(f\"\\n[*] Analyzing: {pcap}\")\n print(f\"[*] Size: {os.path.getsize(pcap)/(1024*1024):.1f} MB\")\n\n print(\"\\n--- Beacon Detection ---\")\n beacons = detect_beaconing(pcap)\n for b in beacons:\n print(f\" [!] {b['flow']}: interval={b['avg_interval']}s \"\n f\"jitter={b['jitter_pct']}% ({b['connections']} conns)\")\n\n print(\"\\n--- Lateral Movement Detection ---\")\n lateral = detect_lateral_movement(pcap)\n for l in lateral[:10]:\n print(f\" [!] {l['src']} -> {l['dst']}:{l['port']} ({l['service']})\")\n\n print(\"\\n--- Data Exfiltration Detection ---\")\n exfil = detect_data_exfiltration(pcap, threshold_mb=5)\n for e in exfil:\n print(f\" [!] {e['ip_a']} \u003c-> {e['ip_b']}: {e['total_mb']} MB\")\n\n print(\"\\n--- DNS Queries ---\")\n dns = extract_dns_queries(pcap)\n print(f\" Total queries: {len(dns)}\")\n\n report = generate_incident_report(pcap, beacons, lateral, exfil, dns)\n print(f\"\\n[*] Report summary: {json.dumps(report['findings'], indent=2)}\")\n else:\n print(f\"\\n[DEMO] Usage: python agent.py \u003ccapture.pcap>\")\n","content_type":"text/x-python; charset=utf-8","language":"python","size":7804,"content_sha256":"f3fa180e73b6ab74e102facdaff0113d80617364b6109686143a8bc130438019"}],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"Analyzing Network Traffic for Incidents","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"When to Use","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"SIEM alerts on anomalous network traffic patterns requiring deeper investigation","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"C2 beaconing is suspected and needs confirmation through packet-level analysis","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Data exfiltration volume or destination must be quantified from network evidence","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Lateral movement between systems needs to be traced through network connections","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"An IDS/IPS alert requires packet-level validation to confirm or dismiss","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Do not use","type":"text","marks":[{"type":"strong"}]},{"text":" for host-based forensic analysis (process execution, file system artifacts); use endpoint forensics tools instead.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Full packet capture (PCAP) infrastructure or on-demand capture capability (network tap, SPAN port)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Wireshark installed on the analysis workstation with appropriate display filters knowledge","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Zeek (formerly Bro) deployed for network metadata generation (conn.log, dns.log, http.log, ssl.log)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"NetFlow/IPFIX collection from network devices for traffic flow analysis","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Network architecture diagram showing VLAN layout, firewall placement, and monitoring points","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Threat intelligence feeds for correlating observed network indicators","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Workflow","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 1: Capture or Acquire Network Traffic","type":"text"}]},{"type":"paragraph","content":[{"text":"Obtain the relevant traffic data for the investigation:","type":"text"}]},{"type":"paragraph","content":[{"text":"Live Capture (if incident is active):","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Capture on specific interface filtering by host\ntcpdump -i eth0 -w capture.pcap host 10.1.5.42\n\n# Capture C2 traffic to specific external IP\ntcpdump -i eth0 -w c2_traffic.pcap host 185.220.101.42\n\n# Capture with rotation (1GB files, keep 10)\ntcpdump -i eth0 -w capture_%Y%m%d%H%M.pcap -C 1000 -W 10","type":"text"}]},{"type":"paragraph","content":[{"text":"From Existing Infrastructure:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Export PCAP from full packet capture appliance (Arkime/Moloch, ExtraHop, Corelight)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Pull Zeek logs from the Zeek cluster for the investigation timeframe","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Export NetFlow data from network devices for high-level traffic analysis","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 2: Identify C2 Communications","type":"text"}]},{"type":"paragraph","content":[{"text":"Detect command-and-control traffic patterns:","type":"text"}]},{"type":"paragraph","content":[{"text":"Beaconing Detection (Zeek conn.log):","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Extract connections to external IPs with regular intervals\ncat conn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p duration orig_bytes resp_bytes \\\n | awk '$4 ~ /^185\\.220/' | sort -t. -k1,1n -k2,2n","type":"text"}]},{"type":"paragraph","content":[{"text":"Wireshark Beacon Analysis:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"# Filter for traffic to suspected C2 IP\nip.addr == 185.220.101.42\n\n# Filter HTTPS traffic to non-standard ports\ntcp.port != 443 && ssl\n\n# Filter DNS queries for suspicious domains\ndns.qry.name contains \"evil\" or dns.qry.name matches \"^[a-z0-9]{32}\\.\"\n\n# Filter HTTP POST (common C2 check-in method)\nhttp.request.method == \"POST\" && ip.dst == 185.220.101.42","type":"text"}]},{"type":"paragraph","content":[{"text":"Beaconing characteristics to identify:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Regular time intervals between connections (e.g., every 60 seconds with 10-15% jitter)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Consistent packet sizes in requests and responses","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"HTTPS to external IPs not associated with legitimate CDNs or services","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"DNS queries with high entropy subdomains (DNS tunneling indicator)","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 3: Analyze Lateral Movement Traffic","type":"text"}]},{"type":"paragraph","content":[{"text":"Trace adversary movement between internal systems:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"Key protocols for lateral movement detection:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nSMB (TCP 445): PsExec, file share access, ransomware propagation\nRDP (TCP 3389): Remote desktop sessions\nWinRM (TCP 5985): PowerShell remoting\nWMI (TCP 135): Remote command execution\nSSH (TCP 22): Linux lateral movement\nDCE/RPC (TCP 135): DCOM-based lateral movement","type":"text"}]},{"type":"paragraph","content":[{"text":"Wireshark Filters for Lateral Movement:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"# SMB lateral movement\nsmb2 && ip.src == 10.1.5.42 && ip.dst != 10.1.5.42\n\n# RDP connections from compromised host\ntcp.dstport == 3389 && ip.src == 10.1.5.42\n\n# Kerberos ticket requests (potential pass-the-ticket)\nkerberos.msg_type == 12 && ip.src == 10.1.5.42\n\n# NTLM authentication (potential pass-the-hash)\nntlmssp.auth.username && ip.src == 10.1.5.42","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 4: Detect Data Exfiltration","type":"text"}]},{"type":"paragraph","content":[{"text":"Identify unauthorized data transfers leaving the network:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"# Identify large outbound transfers in Zeek conn.log\ncat conn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p orig_bytes \\\n | awk '$5 > 100000000' | sort -t

Analyzing Network Traffic for Incidents When to Use - SIEM alerts on anomalous network traffic patterns requiring deeper investigation - C2 beaconing is suspected and needs confirmation through packet-level analysis - Data exfiltration volume or destination must be quantified from network evidence - Lateral movement between systems needs to be traced through network connections - An IDS/IPS alert requires packet-level validation to confirm or dismiss Do not use for host-based forensic analysis (process execution, file system artifacts); use endpoint forensics tools instead. Prerequisites - Fu…

\\t' -k5 -rn\n\n# DNS tunneling detection (high volume of TXT queries)\ncat dns.log | zeek-cut query qtype | grep TXT | cut -f1 \\\n | rev | cut -d. -f1,2 | rev | sort | uniq -c | sort -rn | head\n\n# Unusual protocol usage (ICMP tunneling, DNS over HTTPS)\ncat conn.log | zeek-cut proto id.resp_p orig_bytes | awk '$1 == \"icmp\" && $3 > 1000'","type":"text"}]},{"type":"paragraph","content":[{"text":"Wireshark Exfiltration Filters:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"# Large HTTP POST uploads\nhttp.request.method == \"POST\" && tcp.len > 10000\n\n# FTP data transfers\nftp-data && ip.src == 10.0.0.0/8\n\n# DNS with large TXT responses (tunneling)\ndns.resp.type == 16 && dns.resp.len > 200","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 5: Extract and Correlate IOCs","type":"text"}]},{"type":"paragraph","content":[{"text":"Pull network-based indicators from traffic analysis:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"External IP addresses contacted by compromised hosts","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Domains resolved via DNS during the incident timeframe","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"URLs accessed via HTTP/HTTPS (if SSL inspection is in place)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"TLS certificate details (subject, issuer, serial number, JA3/JA3S hashes)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"User-Agent strings from HTTP requests","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"File transfers captured in PCAP (extract using Wireshark Export Objects)","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 6: Document Network Forensic Findings","type":"text"}]},{"type":"paragraph","content":[{"text":"Compile analysis into a structured report with evidence references:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Reference specific PCAP files, frame numbers, and timestamps for each finding","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Include packet captures of key evidence as screenshots or exported PDFs","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Map network activity to the incident timeline","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Correlate network findings with host-based evidence from endpoint forensics","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Key Concepts","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Term","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Definition","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PCAP (Packet Capture)","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"File format storing raw network packets captured from a network interface for offline analysis","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Beaconing","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Regular, periodic network connections from a compromised host to a C2 server, identifiable by consistent timing intervals","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"JA3/JA3S","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"TLS client and server fingerprinting method based on the ClientHello and ServerHello parameters; unique per application","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"NetFlow/IPFIX","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Network traffic metadata (source, destination, ports, bytes, duration) collected by routers and switches without full packet capture","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"DNS Tunneling","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Technique encoding data in DNS queries and responses to exfiltrate data or maintain C2 through DNS protocol","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Network Tap","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Hardware device that creates an exact copy of network traffic for monitoring without impacting network performance","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Zeek Logs","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Structured metadata logs generated by the Zeek network analysis framework covering connections, DNS, HTTP, SSL, and more","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Tools & Systems","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Wireshark","type":"text","marks":[{"type":"strong"}]},{"text":": Open-source packet analyzer for deep inspection of network protocols at the packet level","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Zeek (formerly Bro)","type":"text","marks":[{"type":"strong"}]},{"text":": Network analysis framework generating structured metadata logs from live or captured traffic","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Arkime (formerly Moloch)","type":"text","marks":[{"type":"strong"}]},{"text":": Open-source full packet capture and search platform for large-scale network forensics","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"NetworkMiner","type":"text","marks":[{"type":"strong"}]},{"text":": Network forensic analysis tool for extracting files, images, and credentials from PCAP files","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"RITA (Real Intelligence Threat Analytics)","type":"text","marks":[{"type":"strong"}]},{"text":": Open-source beacon detection and DNS tunneling analysis tool for Zeek logs","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Common Scenarios","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Scenario: Confirming C2 Beaconing and Quantifying Exfiltration","type":"text"}]},{"type":"paragraph","content":[{"text":"Context","type":"text","marks":[{"type":"strong"}]},{"text":": EDR detects a suspicious process on a workstation but cannot determine the volume of data exfiltrated. Network team provides PCAP from the full packet capture appliance covering the incident timeframe.","type":"text"}]},{"type":"paragraph","content":[{"text":"Approach","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Filter PCAP to traffic from the compromised host IP to external destinations","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Identify the C2 channel by analyzing connection timing patterns (beacon detection)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Extract TLS certificate and JA3 hash from the C2 connection for IOC generation","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Calculate total bytes transferred to C2 infrastructure over the incident duration","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Check for additional exfiltration channels (DNS tunneling, cloud storage uploads)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Extract any unencrypted files transferred using Wireshark Export Objects feature","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Pitfalls","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Analyzing only HTTP traffic when C2 is operating over HTTPS without SSL inspection","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Missing DNS tunneling because the data volume per query is small (but total over time is significant)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Not correlating network timestamps with endpoint timestamps (timezone mismatches)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Overlooking legitimate cloud services abused for exfiltration (OneDrive, Google Drive, Dropbox)","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Output Format","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"NETWORK TRAFFIC ANALYSIS REPORT\n=================================\nIncident: INC-2025-1547\nAnalyst: [Name]\nCapture Source: Arkime full packet capture\nAnalysis Period: 2025-11-15 14:00 UTC - 2025-11-15 18:00 UTC\nTotal PCAP Size: 4.7 GB\n\nC2 COMMUNICATIONS\nSource: 10.1.5.42 (WKSTN-042)\nDestination: 185.220.101.42:443 (HTTPS)\nBeacon Interval: 60 seconds ± 12% jitter\nSessions: 237 connections over 4 hours\nJA3 Hash: a0e9f5d64349fb13191bc781f81f42e1\nTLS Certificate: CN=update.evil[.]com (self-signed)\nTotal Data Sent: 147 MB (outbound)\nTotal Data Recv: 2.3 MB (inbound - commands)\n\nLATERAL MOVEMENT\n10.1.5.42 → 10.1.10.15 (SMB, TCP 445) - 14:35 UTC\n10.1.5.42 → 10.1.10.20 (RDP, TCP 3389) - 14:42 UTC\n10.1.5.42 → 10.1.1.5 (LDAP, TCP 389) - 15:10 UTC\n\nEXFILTRATION SUMMARY\nProtocol: HTTPS to C2 server\nVolume: 147 MB outbound\nDuration: 14:23 UTC - 18:00 UTC\nFiles Extracted: [list if recoverable from unencrypted channels]\n\nDNS ANALYSIS\nSuspicious Queries: 0 DNS tunneling indicators\nDGA Detection: 0 algorithmically generated domains\n\nEVIDENCE REFERENCES\nPCAP File: INC-2025-1547_capture.pcap (SHA-256: ...)\nZeek Logs: /logs/zeek/2025-11-15/ (conn.log, ssl.log, dns.log)","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}}]},"metadata":{"date":"2026-06-05","name":"analyzing-network-traffic-for-incidents","tags":["network-forensics","PCAP-analysis","Wireshark","Zeek","traffic-analysis"],"author":"@skillopedia","domain":"cybersecurity","source":{"stars":13207,"repo_name":"anthropic-cybersecurity-skills","origin_url":"https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/analyzing-network-traffic-for-incidents/SKILL.md","repo_owner":"mukul975","body_sha256":"38ff6225d7211e911b2acac2a23d4c003a745d38aa67816e322b7ecdad571169","cluster_key":"9e43dbbe02d399fa0f808457f4d00d29dd987f214d5947ec0298ede77ef7b12d","clean_bundle":{"format":"clean-skill-bundle-v1","source":"mukul975/anthropic-cybersecurity-skills/skills/analyzing-network-traffic-for-incidents/SKILL.md","attachments":[{"id":"e8fc473f-1cf2-5356-b57e-9e124a90874b","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/e8fc473f-1cf2-5356-b57e-9e124a90874b/attachment.md","path":"references/api-reference.md","size":2825,"sha256":"7cd9a7e04c4ab3048575bb43896dfb8338e34c1954e27d307402fa5ef8fc379d","contentType":"text/markdown; charset=utf-8"},{"id":"05167a49-f9d3-554e-90ed-594e1024a45b","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/05167a49-f9d3-554e-90ed-594e1024a45b/attachment.py","path":"scripts/agent.py","size":7804,"sha256":"f3fa180e73b6ab74e102facdaff0113d80617364b6109686143a8bc130438019","contentType":"text/x-python; charset=utf-8"}],"bundle_sha256":"f30d2169203eceafab9e746f41cd6ab98f1b70e0c341990efbbfa14dff4dca49","attachment_count":2,"text_attachments":2,"attachment_storage":"skillopedia-attachments-v1","binary_attachments":0,"excluded_attachments":[]},"cluster_size":2,"skill_md_path":"skills/analyzing-network-traffic-for-incidents/SKILL.md","import_metadata":{"date":"2026-06-05","author":"@skillopedia","version":"v1","category":"security","category_label":"Security"},"exact_dupes_collapsed_into_this":1},"license":"Apache-2.0","version":"v1","category":"security","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"],"subdomain":"incident-response","import_tag":"clean-skills-v1","description":"Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.\n","mitre_attack":["T1071","T1095","T1573","T1572"]}},"renderedAt":1782981793913}

Analyzing Network Traffic for Incidents When to Use - SIEM alerts on anomalous network traffic patterns requiring deeper investigation - C2 beaconing is suspected and needs confirmation through packet-level analysis - Data exfiltration volume or destination must be quantified from network evidence - Lateral movement between systems needs to be traced through network connections - An IDS/IPS alert requires packet-level validation to confirm or dismiss Do not use for host-based forensic analysis (process execution, file system artifacts); use endpoint forensics tools instead. Prerequisites - Fu…