Kernel of Truth

Packet Analysis

🧪 How to Perform Packet Analysis

Packet analysis (also known as packet sniffing or network traffic analysis) is the process of capturing, inspecting, and interpreting network data as it traverses a network. It is a vital skill in cybersecurity for identifying threats, troubleshooting network issues, and understanding communications.

🔍 Why Packet Analysis Is Important

  • Threat Detection: Identify malware, C2 communications, and unauthorised data exfiltration.
  • Incident Response: Understand what happened during an attack (e.g. phishing payload delivery).
  • Network Troubleshooting: Find misconfigurations or bottlenecks in data flow.
  • Compliance Audits: Validate encrypted traffic, detect data leaks, or ensure protocol usage.

🧰 Tools You’ll Need

ToolDescription
WiresharkThe most popular GUI-based packet analyser. Free and feature-rich.
tcpdumpA command-line packet capture tool available on most Linux systems.
TsharkThe CLI version of Wireshark for scripting and automation.
Zeek (formerly Bro)A powerful network security monitoring tool with protocol analysis.
NetworkMinerA forensics-focused tool that can extract files and metadata from captures.

🛠️ How to Get Started

1. Install a Packet Capture Tool

  • Download and install Wireshark: https://www.wireshark.org
  • Or use tcpdump on Linux: bashCopyEditsudo tcpdump -i eth0 -w capture.pcap

2. Choose the Right Network Interface

In Wireshark, select the network interface you want to monitor (e.g. Ethernet, Wi-Fi, eth0, wlan0). Click Start Capture.

3. Capture Packets

  • Let the tool run while the suspicious activity or issue occurs.
  • Stop the capture and save the .pcap file.

4. Apply Filters to Focus the Analysis

Wireshark display filters let you isolate specific traffic. Examples:

  • http – Shows only HTTP traffic.
  • ip.addr == 192.168.0.10 – Filters all traffic from or to this IP.
  • tcp.port == 443 – Focus on HTTPS traffic.
  • frame contains "password" – Search for sensitive data in plain text.

5. Inspect Individual Packets

Click on any packet to view:

  • Frame summary: Size, capture time.
  • Protocol layers: Ethernet, IP, TCP/UDP, Application.
  • Payload data: Hex and ASCII, viewable at the bottom.

6. Follow Streams

To reconstruct full sessions (e.g. HTTP requests):

  • Right-click on a packet → Follow TCP stream (or UDP).
  • View chat, login sessions, file transfers in raw or reassembled format.

🎯 What to Look For

IndicatorExplanation
Unusual PortsUnexpected use of ports like 4444, 1337 may suggest malware.
Outbound ConnectionsFrequent or strange IPs being contacted can indicate data exfiltration.
Suspicious PayloadsCleartext credentials, encoded payloads, or known exploit signatures.
Malformed PacketsMay suggest scanning, fuzzing, or DOS attempts.
TLS Handshake FailuresCould signal interception attempts or misconfigurations.

🧪 Sample Use Case: Investigating Phishing

  1. Capture traffic while user clicks phishing link.
  2. Filter by ip.addr == victim_ip.
  3. Follow HTTP stream to identify payload URL.
  4. Extract file download and scan using VirusTotal or YARA rules.
  5. Check for beaconing or C2 traffic using filter: dns.qry.name contains "xyz".

⚠️ Legal and Ethical Notice

Only analyse packet data:

  • On networks you own or have permission to monitor
  • With explicit consent for user data inspection
  • In compliance with laws like GDPR, HIPAA, etc.

📚 Resources