> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/blue/wireshark-incident-response-ir.md).

# Wireshark Incident Response (IR)

## Capturing Traffic

Okay okay first things first. How does one actually capture the traffic? There's a number of ways, both *passive* and *active*. An example of a passive method is listening on a [hub](#glossary) by putting your [NIC](#glossary) into promiscuous mode and starting a Wireshark capture. Some active methods include ARP poisoning, in-line network tapping, SPAN/Mirror port, or via firewall captures. For ease of use, there exist VMs like SecurityOnion that are pre-equipped with packet capture software and integrate to display networking statistics on Kibana (i.e. such as how many packets on a given port or otherwise).

<table><thead><tr><th>TOOLS</th><th>DATA / PURPOSE</th><th data-hidden></th></tr></thead><tbody><tr><td>Session Data</td><td>(srcIP, dstIP, srcPort, dstPort, protocol)</td><td></td></tr><tr><td>Syslog</td><td>Transaction Data (DHCP, DNS, Web, Mail)</td><td></td></tr><tr><td>Snort Alert</td><td>Alerts produced by IDS/IPS rules</td><td></td></tr><tr><td>Utilization</td><td>Statistical data like average frequency and flow</td><td></td></tr><tr><td>Wireshark</td><td>Full packet capture (HTTP req/resp, TCP, UDP)</td><td></td></tr><tr><td>tShark</td><td>Like Wireshark but cmdline</td><td></td></tr><tr><td>CloudShark</td><td>Automatic detection of suspicious traffic for uploaded PCAP files.</td><td></td></tr><tr><td><a href="https://lab.dynamite.ai/">PacketTotal</a></td><td>Similar to CloudShark</td><td></td></tr><tr><td><a href="https://www.netresec.com/?page=NetworkMiner">NetworkMiner</a></td><td>Automatic tool for pulling credentials, images, and other objects from uploaded PCAPs</td><td></td></tr></tbody></table>

## Useful Capture Filters

| FILTER                    | USAGE                                        |
| ------------------------- | -------------------------------------------- |
| Filter Port               | tcp.port==80                                 |
| Filter Out Protocol       | not arp                                      |
| Filter Protocol           | http, https, dns, bootp (dhcp)               |
| Filter HTTP Method        | http.request.method==GET                     |
| SSL Handshake Phases      | ssl.handshake.type==1                        |
| Filter DNS Servers        | dns.qry.name contains "suspicious.com"       |
| GeoIP Summary             | ip.geoip.src\_summary                        |
| IP Packets Out-of-Country | ip and not ip.geoip.country=="United States" |
| Text in Packets           | frame contains "password"                    |
| Logical Operators         | (ip.src == 192.168.56.1) && (tcp.port==80)   |
| Slow Connections          | tcp.analysis.retransmission                  |
| Port Scanning             | tcp.flags.syn == 1 && tcp.flags.ack == 0     |
|                           |                                              |

## Exporting Objects

{% hint style="info" %}
Warning: if you do extract a malicious binary, don't execute it unless you know what you're doing!
{% endhint %}

lorem ipsum

## Profiles

Profiles contain sets of customizations for Wireshark such as different coloring rules, columns, or fields. You might use a specific profile for SMB traffic, or perhaps another of malware analysis, or even HTTP/HTTPS traffic just for ease of use and detecting patterns.

## Glossary

<table><thead><tr><th>TERM</th><th>DEFINITION</th><th data-hidden></th><th data-hidden></th></tr></thead><tbody><tr><td>Hub</td><td>device that connects multiple computers or other network devices in a LAN</td><td></td><td></td></tr><tr><td>NIC</td><td>Network Interface Card</td><td></td><td></td></tr><tr><td>SOL</td><td>Shit Out of Luck</td><td></td><td></td></tr></tbody></table>

## Resources

1. [Wireshark for Incident Response & Threat Hunting Workshop @ OWASP SB](https://www.youtube.com/watch?v=8jqNjo-LqYw)
2. [Wireshark Cheatsheet](https://parrot-ctfs.com/blog/the-ultimate-wireshark-cheat-sheet-master-network-analysis-like-a-pro/)
3. [Apache Logs](https://www.bing.com/ck/a?!&\&p=29f9d75efce2ef62ff2e0069d42b9dd94180b92dfc755fdea5cc4fcd3d2fcc21JmltdHM9MTc0MTk5NjgwMA\&ptn=3\&ver=2\&hsh=4\&fclid=03e91e11-41ce-615a-19f3-0c77403360ca\&u=a1aHR0cHM6Ly93d3cuc2xpbmdhY2FkZW15LmNvbS9hcnRpY2xlL21hbmFnaW5nLWxvZy1maWxlcy1pbi1hcGFjaGUv\&ntb=1)
4. [Profiles](https://github.com/amwalding/wireshark_profiles)
5. [DNSCat](https://github.com/iagox86/dnscat2)
6. [Kerberos Packet Capture](https://medium.com/@robert.broeckelmann/kerberos-wireshark-captures-a-windows-login-example-151fabf3375a)
7. [TCPDump](https://www.tcpdump.org/manpages/tcpdump.1.html)