Performing Network Forensics with Wireshark

When to Use

• When analyzing captured network traffic (PCAP files) from a security incident
• For identifying command-and-control (C2) communications in captured traffic
• When reconstructing data exfiltration activities from packet captures
• During malware analysis to identify network indicators of compromise
• For extracting files, credentials, and artifacts transferred over the network

Prerequisites

• Wireshark or tshark installed for packet analysis
• PCAP/PCAPNG files from network captures (tcpdump, Wireshark, network TAP)
• NetworkMiner for automated artifact extraction
• Sufficient RAM for large capture files (1GB+ PCAPs need 8GB+ RAM)
• Understanding of TCP/IP, HTTP, DNS, TLS protocols
• GeoIP databases for IP geolocation

Workflow