Analyzing Network Traffic with Wireshark

使用Wireshark分析网络流量

When to Use

适用场景

Investigating suspected network intrusions by examining packet-level evidence of command-and-control traffic, data exfiltration, or lateral movement
Diagnosing network performance issues such as retransmissions, fragmentation, or DNS resolution failures
Analyzing malware communication patterns by capturing traffic from sandboxed or isolated hosts
Validating firewall and IDS rules by confirming what traffic is actually traversing network segments
Extracting files, credentials, or indicators of compromise from captured network sessions

Do not use to capture traffic on networks without authorization, to intercept private communications without legal authority, or as a substitute for full-featured SIEM platforms in production monitoring.

通过检查命令与控制流量、数据泄露或横向移动的数据包级证据，调查疑似网络入侵
诊断网络性能问题，如重传、分片或DNS解析失败
通过捕获沙箱或隔离主机的流量，分析恶意软件通信模式
通过确认实际流经网段的流量，验证防火墙和IDS规则
从捕获的网络会话中提取文件、凭证或威胁指标（IOC）

禁止使用场景：未经授权捕获网络流量、无法律授权拦截私人通信，或在生产监控中替代全功能SIEM平台。

Prerequisites

前提条件

Wireshark 4.0+ and tshark command-line utility installed
Root/sudo privileges or membership in the
```
wireshark
```
group for live packet capture
Network interface access (physical NIC, span port, or network tap) to the monitored segment
Sufficient disk space for packet capture files (estimate 1 GB per minute on busy gigabit links)
Familiarity with TCP/IP protocols, HTTP, DNS, TLS, and SMB at the packet level

已安装Wireshark 4.0+及tshark命令行工具
具备Root/sudo权限或属于
```
wireshark
```
用户组，以进行实时数据包捕获
可访问受监控网段的网络接口（物理网卡、镜像端口或网络分流器）
有足够磁盘空间存储数据包捕获文件（繁忙千兆链路估计每分钟1GB）
熟悉数据包层面的TCP/IP协议、HTTP、DNS、TLS和SMB

Workflow

工作流程

Step 1: Configure Capture Environment

步骤1：配置捕获环境

Set up the capture interface and filters to target relevant traffic:

bash

undefined

设置捕获接口和过滤器，定位相关流量：

bash

undefined

List available interfaces

列出可用接口

tshark -D

Start capture on eth0 with a capture filter to limit scope

在eth0上启动捕获，使用捕获过滤器限制范围

tshark -i eth0 -f "host 10.10.5.23 and (port 80 or port 443 or port 445)" -w /tmp/capture.pcapng

Capture with ring buffer to manage disk usage (10 files, 100MB each)

使用环形缓冲区管理磁盘占用（10个文件，每个100MB）

tshark -i eth0 -b filesize:102400 -b files:10 -w /tmp/rolling_capture.pcapng

Capture on multiple interfaces simultaneously

同时在多个接口上捕获

tshark -i eth0 -i eth1 -w /tmp/multi_interface.pcapng


For Wireshark GUI, set capture filter in the Capture Options dialog before starting.

tshark -i eth0 -i eth1 -w /tmp/multi_interface.pcapng


对于Wireshark图形界面，在开始捕获前于“捕获选项”对话框中设置捕获过滤器。

Step 2: Apply Display Filters for Targeted Analysis

步骤2：应用显示过滤器进行针对性分析

bash

undefined

bash

undefined

Filter HTTP traffic containing suspicious user agents

过滤包含可疑用户代理的HTTP流量

tshark -r capture.pcapng -Y "http.user_agent contains "curl" or http.user_agent contains "Wget""

Find DNS queries to suspicious TLDs

查找指向可疑顶级域名的DNS查询

tshark -r capture.pcapng -Y "dns.qry.name contains ".xyz" or dns.qry.name contains ".top" or dns.qry.name contains ".tk""

Identify TCP retransmissions indicating network issues

识别指示网络问题的TCP重传

tshark -r capture.pcapng -Y "tcp.analysis.retransmission"

Filter SMB traffic for lateral movement detection

过滤SMB流量以检测横向移动

tshark -r capture.pcapng -Y "smb2.cmd == 5 or smb2.cmd == 3" -T fields -e ip.src -e ip.dst -e smb2.filename

Find cleartext credential transmission

查找明文凭证传输

tshark -r capture.pcapng -Y "ftp.request.command == "PASS" or http.authbasic"

Detect beaconing patterns (regular interval connections)

检测 beaconing 模式（定期间隔连接）

tshark -r capture.pcapng -Y "ip.dst == 203.0.113.50" -T fields -e frame.time_relative -e ip.src -e tcp.dstport

undefined

tshark -r capture.pcapng -Y "ip.dst == 203.0.113.50" -T fields -e frame.time_relative -e ip.src -e tcp.dstport

undefined

Step 3: Protocol-Specific Deep Analysis

步骤3：协议深度分析

bash

undefined

bash

undefined

Follow a TCP stream to reconstruct a conversation

跟踪TCP流以重建会话

tshark -r capture.pcapng -q -z follow,tcp,ascii,0

Analyze HTTP request/response pairs

分析HTTP请求/响应对

tshark -r capture.pcapng -Y "http" -T fields -e frame.time -e ip.src -e ip.dst -e http.request.method -e http.request.uri -e http.response.code

Extract DNS query/response statistics

提取DNS查询/响应统计数据

tshark -r capture.pcapng -q -z dns,tree

Analyze TLS handshakes for weak cipher suites

分析TLS握手以查找弱密码套件

tshark -r capture.pcapng -Y "tls.handshake.type == 2" -T fields -e ip.src -e ip.dst -e tls.handshake.ciphersuite

SMB file access enumeration

SMB文件访问枚举

tshark -r capture.pcapng -Y "smb2" -T fields -e frame.time -e ip.src -e ip.dst -e smb2.filename -e smb2.cmd

undefined

tshark -r capture.pcapng -Y "smb2" -T fields -e frame.time -e ip.src -e ip.dst -e smb2.filename -e smb2.cmd

undefined

Step 4: Extract Artifacts and IOCs

步骤4：提取取证工件与威胁指标（IOC）

bash

undefined

bash

undefined

Export HTTP objects (files transferred over HTTP)

导出HTTP对象（通过HTTP传输的文件）

tshark -r capture.pcapng --export-objects http,/tmp/http_objects/

Export SMB objects (files transferred over SMB)

导出SMB对象（通过SMB传输的文件）

tshark -r capture.pcapng --export-objects smb,/tmp/smb_objects/

Extract all unique destination IPs for threat intelligence lookup

提取所有唯一目标IP用于威胁情报查询

tshark -r capture.pcapng -T fields -e ip.dst | sort -u > unique_dest_ips.txt

Extract SSL/TLS certificate information

提取SSL/TLS证书信息

tshark -r capture.pcapng -Y "tls.handshake.type == 11" -T fields -e x509sat.uTF8String -e x509ce.dNSName

Extract all URLs accessed

提取所有访问过的URL

tshark -r capture.pcapng -Y "http.request" -T fields -e http.host -e http.request.uri | sort -u > urls.txt

Hash extracted files for IOC matching

对提取的文件进行哈希计算以匹配威胁指标

find /tmp/http_objects/ -type f -exec sha256sum {} ; > extracted_file_hashes.txt

undefined

find /tmp/http_objects/ -type f -exec sha256sum {} ; > extracted_file_hashes.txt

undefined

Step 5: Statistical Analysis and Anomaly Detection

步骤5：统计分析与异常检测

bash

undefined

bash

undefined

Protocol hierarchy statistics

协议层级统计

tshark -r capture.pcapng -q -z io,phs

Conversation statistics sorted by bytes

按字节排序的会话统计

tshark -r capture.pcapng -q -z conv,tcp -z conv,udp

Identify top talkers

识别顶级通信方

tshark -r capture.pcapng -q -z endpoints,ip

IO graph data (packets per second)

IO图表数据（每秒数据包数）

tshark -r capture.pcapng -q -z io,stat,1,"COUNT(frame) frame"

Detect port scanning patterns

检测端口扫描模式

tshark -r capture.pcapng -Y "tcp.flags.syn == 1 and tcp.flags.ack == 0" -T fields -e ip.src -e tcp.dstport | sort | uniq -c | sort -rn | head -20

undefined

tshark -r capture.pcapng -Y "tcp.flags.syn == 1 and tcp.flags.ack == 0" -T fields -e ip.src -e tcp.dstport | sort | uniq -c | sort -rn | head -20

undefined

Step 6: Generate Reports and Export Evidence

步骤6：生成报告与导出证据

bash

undefined

bash

undefined

Export filtered packets to a new PCAP for evidence preservation

将过滤后的数据包导出到新的PCAP文件以保存证据

tshark -r capture.pcapng -Y "ip.addr == 10.10.5.23 and tcp.port == 4444" -w evidence_c2_traffic.pcapng

Generate packet summary in CSV format

生成CSV格式的数据包摘要

tshark -r capture.pcapng -T fields -E header=y -E separator=, -e frame.number -e frame.time -e ip.src -e ip.dst -e ip.proto -e tcp.srcport -e tcp.dstport -e frame.len > traffic_summary.csv

Create PDML (XML) output for programmatic analysis

创建PDML（XML）输出用于程序化分析

tshark -r capture.pcapng -T pdml > capture_analysis.xml

Calculate capture file hash for chain of custody

计算捕获文件的哈希值以维护监管链

sha256sum capture.pcapng > capture_hash.txt

undefined

sha256sum capture.pcapng > capture_hash.txt

undefined

Key Concepts

核心概念

Term	Definition
Capture Filter (BPF)	Berkeley Packet Filter syntax applied at capture time to limit which packets are recorded, reducing file size and improving performance
Display Filter	Wireshark-specific filter syntax applied to already-captured packets for focused analysis without altering the capture file
PCAPNG	Next-generation packet capture format supporting multiple interfaces, name resolution, annotations, and metadata in a single file
TCP Stream	Reassembled sequence of TCP segments representing a complete bidirectional conversation between two endpoints
Protocol Dissector	Wireshark module that decodes a specific protocol's fields and structure, enabling deep inspection of packet contents
IO Graph	Time-series visualization of packet or byte rates over the capture duration, useful for identifying traffic spikes or beaconing

术语	定义
Capture Filter (BPF)	捕获时应用的伯克利数据包过滤器语法，用于限制记录的数据包，减少文件大小并提升性能
Display Filter	Wireshark特有的过滤器语法，应用于已捕获的数据包以进行聚焦分析，不会修改捕获文件
PCAPNG	下一代数据包捕获格式，支持在单个文件中存储多接口数据、名称解析、注释和元数据
TCP Stream	重新组装的TCP段序列，代表两个端点之间完整的双向会话
Protocol Dissector	Wireshark模块，用于解码特定协议的字段和结构，实现对数据包内容的深度检查
IO Graph	捕获期间数据包或字节速率的时间序列可视化，有助于识别流量峰值或beaconing模式

Tools & Systems

工具与系统

Wireshark 4.0+: GUI-based packet analyzer with protocol dissectors for 3,000+ protocols, stream reassembly, and export capabilities
tshark: Command-line version of Wireshark for headless capture, batch processing, and scripted analysis pipelines
tcpdump: Lightweight packet capture tool for quick captures on remote systems without GUI dependencies
mergecap: Wireshark utility for combining multiple capture files into a single PCAP for unified analysis
editcap: Wireshark utility for splitting, filtering, and converting between capture file formats

Wireshark 4.0+: 基于图形界面的数据包分析器，支持3000+协议的协议解析器、流重组和导出功能
tshark: Wireshark的命令行版本，用于无界面捕获、批量处理和脚本化分析流水线
tcpdump: 轻量级数据包捕获工具，用于在无GUI依赖的远程系统上快速捕获
mergecap: Wireshark工具，用于将多个捕获文件合并为单个PCAP以进行统一分析
editcap: Wireshark工具，用于拆分、过滤和转换捕获文件格式

Common Scenarios

常见场景

Scenario: Investigating Suspected Data Exfiltration via DNS Tunneling

场景：调查疑似通过DNS隧道进行的数据泄露

Context: The SOC team detected unusually high DNS query volumes from a workstation (10.10.3.45) to an external domain. The SIEM alert flagged DNS queries averaging 200 per minute compared to the baseline of 15. A packet capture was initiated from the network tap on the workstation's VLAN.

Approach:

Capture traffic from the workstation's subnet using

tshark -i eth2 -f "host 10.10.3.45 and port 53" -w dns_exfil_investigation.pcapng

Analyze DNS query patterns:

tshark -r dns_exfil_investigation.pcapng -Y "dns.qry.name contains \"suspect-domain.xyz\"" -T fields -e frame.time -e dns.qry.name

Examine subdomain labels for encoded data (long base64-like subdomains indicate tunneling):

tshark -r dns_exfil_investigation.pcapng -Y "dns.qry.type == 16" -T fields -e dns.qry.name -e dns.txt

Calculate data volume by summing query name lengths to estimate exfiltration bandwidth
Extract unique query names and decode base64 subdomains to recover exfiltrated content
Export evidence packets to a separate PCAP and generate SHA-256 hash for chain of custody

Pitfalls:

Capturing unfiltered traffic on a busy network and running out of disk space before collecting relevant data
Using display filters instead of capture filters, resulting in massive files that are slow to process
Overlooking encrypted DNS (DoH/DoT) traffic that bypasses traditional DNS capture on port 53
Failing to establish packet capture hash and chain of custody documentation for forensic evidence

背景: SOC团队检测到某工作站（10.10.3.45）向外部域名发送的DNS查询量异常偏高。SIEM警报显示DNS查询平均每分钟200次，而基线为15次。已从该工作站所在VLAN的网络分流器启动数据包捕获。

方法:

使用

tshark -i eth2 -f "host 10.10.3.45 and port 53" -w dns_exfil_investigation.pcapng

捕获工作站子网的流量

分析DNS查询模式：

tshark -r dns_exfil_investigation.pcapng -Y "dns.qry.name contains \"suspect-domain.xyz\"" -T fields -e frame.time -e dns.qry.name

检查子域名标签中的编码数据（长类base64子域名表明存在隧道）：

tshark -r dns_exfil_investigation.pcapng -Y "dns.qry.type == 16" -T fields -e dns.qry.name -e dns.txt

通过求和查询名称长度计算数据量，估计泄露带宽
提取唯一查询名称并解码base64子域名以恢复泄露内容
将证据数据包导出到单独的PCAP文件，并生成SHA-256哈希值以维护监管链

注意事项:

在繁忙网络上捕获未过滤的流量，导致在收集到相关数据前磁盘空间耗尽
使用显示过滤器而非捕获过滤器，生成的文件过大，处理缓慢
忽略绕过传统端口53 DNS捕获的加密DNS（DoH/DoT）流量
未为取证证据建立数据包捕获哈希和监管链文档

Output Format

输出格式

undefined

undefined

Traffic Analysis Report

流量分析报告

Case ID: IR-2024-0847 Capture File: dns_exfil_investigation.pcapng SHA-256: a3f2b8c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1 Duration: 2024-03-15 14:00:00 to 14:45:00 UTC Source Interface: eth2 (VLAN 30 span port)

案例ID: IR-2024-0847 捕获文件: dns_exfil_investigation.pcapng SHA-256: a3f2b8c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1 持续时间: 2024-03-15 14:00:00 至 14:45:00 UTC 源接口: eth2（VLAN 30镜像端口）

Findings

调查结果

1. DNS Tunneling Confirmed

Source: 10.10.3.45
Destination DNS: 8.8.8.8 (forwarded to ns1.suspect-domain.xyz)
Query volume: 9,247 queries in 45 minutes (205/min vs 15/min baseline)
Average subdomain label length: 63 characters (base64-encoded data)
Estimated data exfiltrated: ~2.3 MB via TXT record responses

2. Indicators of Compromise

Domain: suspect-domain.xyz (registered 3 days prior)
Nameserver: ns1.suspect-domain.xyz (203.0.113.50)
Query pattern: TXT record requests with base64-encoded subdomains
Response pattern: TXT records containing base64-encoded payloads

undefined

1. DNS隧道已确认

源IP: 10.10.3.45
目标DNS: 8.8.8.8（转发至ns1.suspect-domain.xyz）
查询量: 45分钟内9247次查询（每分钟205次 vs 基线每分钟15次）
平均子域名标签长度: 63字符（base64编码数据）
估计泄露数据量: 通过TXT记录响应泄露约2.3 MB

2. 威胁指标（IOC）

域名: suspect-domain.xyz（3天前注册）
域名服务器: ns1.suspect-domain.xyz（203.0.113.50）
查询模式: 带base64编码子域名的TXT记录请求
响应模式: 包含base64编码载荷的TXT记录

undefined

analyzing-network-traffic-with-wireshark

Original

Translation

Analyzing Network Traffic with Wireshark

使用Wireshark分析网络流量

When to Use

适用场景

Prerequisites

前提条件

Workflow

工作流程

Step 1: Configure Capture Environment

步骤1：配置捕获环境

List available interfaces

列出可用接口

Start capture on eth0 with a capture filter to limit scope

在eth0上启动捕获，使用捕获过滤器限制范围

Capture with ring buffer to manage disk usage (10 files, 100MB each)

使用环形缓冲区管理磁盘占用（10个文件，每个100MB）

Capture on multiple interfaces simultaneously

同时在多个接口上捕获

Step 2: Apply Display Filters for Targeted Analysis

步骤2：应用显示过滤器进行针对性分析

Filter HTTP traffic containing suspicious user agents

过滤包含可疑用户代理的HTTP流量

Find DNS queries to suspicious TLDs

查找指向可疑顶级域名的DNS查询

Identify TCP retransmissions indicating network issues

识别指示网络问题的TCP重传

Filter SMB traffic for lateral movement detection

过滤SMB流量以检测横向移动

Find cleartext credential transmission

查找明文凭证传输

Detect beaconing patterns (regular interval connections)

检测 beaconing 模式（定期间隔连接）

Step 3: Protocol-Specific Deep Analysis

步骤3：协议深度分析

Follow a TCP stream to reconstruct a conversation

跟踪TCP流以重建会话

Analyze HTTP request/response pairs

分析HTTP请求/响应对

Extract DNS query/response statistics

提取DNS查询/响应统计数据

Analyze TLS handshakes for weak cipher suites

分析TLS握手以查找弱密码套件

SMB file access enumeration

SMB文件访问枚举

Step 4: Extract Artifacts and IOCs

步骤4：提取取证工件与威胁指标（IOC）

Export HTTP objects (files transferred over HTTP)

导出HTTP对象（通过HTTP传输的文件）

Export SMB objects (files transferred over SMB)

导出SMB对象（通过SMB传输的文件）

Extract all unique destination IPs for threat intelligence lookup

提取所有唯一目标IP用于威胁情报查询

Extract SSL/TLS certificate information

提取SSL/TLS证书信息

Extract all URLs accessed

提取所有访问过的URL

Hash extracted files for IOC matching

对提取的文件进行哈希计算以匹配威胁指标

Step 5: Statistical Analysis and Anomaly Detection

步骤5：统计分析与异常检测

Protocol hierarchy statistics

协议层级统计

Conversation statistics sorted by bytes

按字节排序的会话统计

Identify top talkers

识别顶级通信方

IO graph data (packets per second)

IO图表数据（每秒数据包数）

Detect port scanning patterns

检测端口扫描模式

Step 6: Generate Reports and Export Evidence

步骤6：生成报告与导出证据

Export filtered packets to a new PCAP for evidence preservation

将过滤后的数据包导出到新的PCAP文件以保存证据

Generate packet summary in CSV format

生成CSV格式的数据包摘要

Create PDML (XML) output for programmatic analysis