Network Traffic Analysis
Capturing and analyzing network traffic reveals credentials, sensitive data, and attack patterns. Essential for both offense and defense.
Traffic Capture Methods
Local Capture
Capture traffic on your own interface. See all traffic your NIC receives.
- • Wireshark, tcpdump, tshark
- • Promiscuous mode for all local traffic
- • Limited to broadcast domain
SPAN/Mirror Port
Switch copies traffic from one port to another. Used for legitimate monitoring.
- • Requires switch access
- • Can mirror VLANs or ports
- • May drop packets under load
ARP Spoofing (MITM)
Poison ARP cache to redirect traffic through attacker machine.
- • arpspoof, ettercap, bettercap
- • Captures traffic between hosts
- • Detectable by IDS/monitoring
Network Tap
Physical device that copies all traffic. Passive and invisible.
- • Hardware solution
- • No packet loss
- • Requires physical access
Analysis Workflow
What to Look For
🔓 Credentials in Transit
- • FTP login (port 21) - plaintext
- • Telnet (port 23) - plaintext
- • HTTP Basic Auth - Base64 (decode it!)
- • HTTP POST with login forms
- • SMTP auth (port 25)
- • POP3/IMAP (110/143)
📁 File Transfers
- • SMB file shares (Follow TCP stream)
- • HTTP downloads (Export Objects)
- • FTP data transfers
- • Email attachments (SMTP/IMAP)
- • Look for magic bytes (MZ, PK, PDF)
🔍 Reconnaissance Activity
- • Port scans (SYN packets to many ports)
- • DNS queries (subdomain enum)
- • ICMP sweeps (ping scan)
- • Service banner grabbing
- • LDAP/AD queries
🦠 Malicious Indicators
- • C2 beacons (regular intervals)
- • DNS tunneling (long subdomain names)
- • Unusual ports for known protocols
- • Large outbound data transfers
- • Connections to known bad IPs
Capture & Analysis Commands
tcpdump - Quick Capture
# Capture on interface to file
tcpdump -i eth0 -w capture.pcap
# Capture specific host
tcpdump -i eth0 host 192.168.1.100 -w host.pcap
# Capture specific port
tcpdump -i eth0 port 80 -w http.pcap
# Live analysis with filters
tcpdump -i eth0 'tcp port 21' -A # FTP in ASCIItshark - CLI Wireshark
# Extract HTTP hosts
tshark -r capture.pcap -Y "http.request" -T fields -e http.host | sort -u
# Extract DNS queries
tshark -r capture.pcap -Y "dns.qry.name" -T fields -e dns.qry.name | sort -u
# Follow TCP stream
tshark -r capture.pcap -z follow,tcp,ascii,0
# Statistics
tshark -r capture.pcap -z conv,tcpBettercap - MITM Framework
# Start bettercap
sudo bettercap -iface eth0
# Inside bettercap:
net.probe on # Discover hosts
net.show # Show discovered hosts
set arp.spoof.targets 192.168.1.100
arp.spoof on # Start ARP spoofing
net.sniff on # Start packet captureHTTPS Limitation
Protocol-Specific Tips
| Protocol | What to Extract | Wireshark Filter |
|---|---|---|
| HTTP | URLs, cookies, form data, files | http.request or http.response |
| DNS | Queries, responses, tunneling | dns.qry.name contains "target" |
| SMB | Shares, files, usernames | smb2 or smb |
| FTP | Credentials, file transfers | ftp.request.command == "PASS" |
| Telnet | Full session content | telnet (Follow TCP Stream) |
| Kerberos | Tickets, SPNs, usernames | kerberos.CNameString |
Evidence Collection
A traffic finding is whatever you can hand a reviewer to replay. For each claim, keep:
The capture per method:
One pcap per capture method, each with its sha256sum, the interface or mirror source, and the start and stop timestamps.
The artefact, not the summary: The exported file with its own hash, or the request line and headers in which the credential appeared - quoted. "Credentials were visible" is not evidence.
Filter and frame ids: The display filter used and the frame numbers behind each statement, so the finding maps to a byte offset rather than to an impression.
Vantage point: Local NIC, SPAN session, tap or in-line MITM position, and whether the traffic was observed passively or forwarded by your host.
False Positive Identification
- Traffic that never crossed the segment: Switched unicast does not arrive at a port that was not mirrored. An empty capture from the wrong VLAN or interface is a placement error, not a clean result.
- Encrypted payload: TLS 1.3 and QUIC expose metadata only. Finding no credentials in an encrypted session proves the encryption works, and says nothing about the application.
- Base64 is not a secret: HTTP Basic credentials are trivially decodable and often reported as "encrypted". Decode before you classify, and do not report an encoding as a protection.
- Duplicate and retransmitted frames: Retransmissions, offload artefacts and repeated beacons look like patterns worth reporting. Confirm against the conversation view before you write them up.
Capture Verification Checklist
Before you capture
- ☐ Confirm the mirror or tap is authorised in the RoE and note which port or session it is.
- ☐ Set a full snapshot length and a filter narrow enough to be useful but wide enough not to drop the interesting flow.
- ☐ Synchronise clocks so your timestamps line up with the client's logs.
While you analyse
- ☐ Read the protocol hierarchy before filtering, so you know what you are not looking at.
- ☐ Use the conversations view to find beaconing intervals and long-lived flows rather than scrolling packets.
- ☐ Follow a stream end to end before concluding a credential, cookie or token was exposed.
Handling the evidence
- ☐ Hash the capture at acquisition and record the hash in the report.
- ☐ Redact secrets, PII and regulated data before distributing the capture beyond the immediate team.
- ☐ Apply the retention and destruction period agreed in the RoE, and record when it was done.
Remediation & Defense
You cannot inspect what you cannot see, so remove the cleartext first and instrument the rest.
Remove cleartext protocols
- • Retire telnet, FTP, POP3/IMAP without TLS, SNMPv1/v2c and SMBv1 in favour of SSH, SFTP, IMAPS, SNMPv3 and SMB3.
- • Enforce HTTPS with HSTS on every web property and redirect before authentication, not after it.
- • Replace embedded device credentials with certificate or token exchange so a capture yields nothing replayable.
Contain the segment
- • Private VLANs or port isolation, 802.1X on access ports, and dynamic ARP inspection with DHCP snooping to stop in-path capture.
- • Keep monitoring infrastructure on its own management segment with a documented SPAN policy.
- • Treat any host that can capture as a privileged position - least privilege applies to network visibility too.
Instrument what remains
- • Collect flow records and DNS query logs so beaconing and exfiltration are visible without payload access.
- • Use TLS SNI and certificate metadata as the boundary signal when inspection is not permitted.
- • Alert on large outbound transfers and on regular-interval connections to a single destination.