performing-network-forensics-with-wireshark

# Performing Network Forensics with Wireshark ## When to Use - When analyzing captured network traffic (PCAP files) from a security incident - For identifying command-and-control (C2) communications in captured traffic - When reconstructing data exfiltration activities from packet captures - During malware analysis to identify network indicators of compromise - For extracting files, credentials, and artifacts transferred over the network ## Prerequisites - Wireshark or tshark installed for packet analysis - PCAP/PCAPNG files from network captures (tcpdump, Wireshark, network TAP) - NetworkMiner for automated artifact extraction - Sufficient RAM for large capture files (1GB+ PCAPs need 8GB+ RAM) - Understanding of TCP/IP, HTTP, DNS, TLS protocols - GeoIP databases for IP geolocation ## Workflow ### Step 1: Prepare and Validate the Capture File ```bash # Install Wireshark and tshark sudo apt-get install wireshark tshark # Verify the PCAP file capinfos /cases/case-2024-001/network/capture.pcap # Output includes: file type, packet count, capture duration, data size # Example output: # File name: capture.pcap # File type: Wireshark/tcpdump/... - pcap # Number of packets: 1,245,678 # File size: 856 MB # Data size: 823 MB # Capture duration: 3600.123456 seconds # First packet time: 2024-01-15 14:00:00.000000 # Last packet time: 2024-01-15 15:00:00.123456 # Hash the PCAP for integrity sha256sum /cases/case-2024-001/network/cap...