Wireshark

Wireshark Cheatsheet

What It Is

Network protocol analyzer for capturing and inspecting network traffic.

Why It Matters

Essential for analyzing malware C2 communications, DNS queries, and data exfiltration.

Essential Display Filters

dns                          # All DNS traffic
http.request                 # HTTP requests only
tcp.port == 443              # HTTPS traffic
ip.addr == 10.0.0.100       # Traffic to/from specific IP
http.request.method == POST  # POST requests (data exfil)
dns.qry.name contains evil   # DNS queries containing string
tcp.flags.syn == 1           # New TCP connections

Key Actions

• Follow TCP Stream: Right-click → Follow → TCP Stream
• Export HTTP Objects: File → Export Objects → HTTP
• Statistics → Conversations: See all connection pairs
• Statistics → DNS: DNS query statistics

C2 Analysis Workflow

1. Filter for DNS queries from malware IP
2. Identify resolved domains
3. Filter HTTP/HTTPS to those destinations
4. Follow TCP streams to see request/response
5. Look for patterns: beaconing interval, encoded data

Common Mistakes

• Capturing on wrong interface
• Not using display filters (too much noise)
• Missing encrypted traffic analysis (JA3 fingerprints)