> For the complete documentation index, see [llms.txt](https://va9ab0nd.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://va9ab0nd.gitbook.io/notes/forensics/network-pcap-analysis.md).
# Network Pcap Analysis
### what to look in pcap ?
* Anomalies in the pcap file
* file transfer
Anything that looks out of the ordinary is probably worth exploring.
### extract usb data or any data feild using tshark
```
# Read PCAP
"C:\Program Files\Wireshark\tshark.exe" -r pcap2.pcapng
# Read PCAP and Apply Filter
"C:\Program Files\Wireshark\tshark.exe" -r pcap2.pcapng -Y "usb.dst == host"
# Show only the data and pipe it to xxd save HexDump into data.bin
"C:\Program Files\Wireshark\tshark.exe" -r pcap2.pcapng -Y "usb.dst == host" -T fields -e usb.capdata | xxd -r -p > data.bin
```
### Beginner
> strings
```
strings capture.pcap | grep -i flag
```
> extract any files within the PCAP, binwalk (installed by default on Kali)
```
binwalk -e capture.pcap
```
> Wireshark filter for flag string
```
frame contains "flag_format_string"
```
> Identifying Rogue Devices on the Network
```
eth.addr == xx:xx:xx:xx:xx:xx
//(replace the "xx" with the suspicious MAC address)
```
> Extracting Files from Network Traffic
Wireshark's File > Export Objects > HTTP or SMB feature to extract files from the network traffic. You can also use the display filter
```
tcp.stream eq x
//(replace "x" with the TCP stream number) to isolate the TCP stream containing the file transfer
```
> Decrypting SSL/TLS Traffic
you'll need to decrypt the SSL/TLS traffic to find the flag.
* To do this, you'll need to obtain the private key of the server or use the `SSLKEYLOGFILE` environment variable to log the session keys.
* A helpful display filter for this challenge is
```
ssl.handshake.type == 1
```
> Analysing VoIP Calls
Use Wireshark's Telephony > VoIP Calls feature to analyse the call data. Look for unusual call patterns, such as calls with a\
long duration\
high packet loss\
unexpected codec usage
```
sip || rt
```
filters
```
ip.ttl<=10
tcp.port==4444
http.request.method == "GET" && tcp.port==80
http.server contains "IIS" && tcp.srcport!=80
http.server contains "IIS/7.5"
http.server contains "Apache"
string(ip.ttl) matches "[02468]$" even
string(ip.ttl) matches "[13579]$" odd
Images (http.response.code == 200 ) && (http.content_type matches "image(gif||jpeg)")
Advanced Filtering
.......................
Filter: "contains"
Filter: "matches"
Filter: "lower"
Filter: "upper"
http.host matches "\.(php|html)"
Filter: "in"- displays all packets that use 80,443,8080 ports
tcp.port in {80 443 8080}
upper(http.server) contains "APACHE"
lower(http.server) contains "apache"
Filter: "string" - odd numbers ending packets
string(frame.number) matches "[13579]$"
```
#### Decrypting SSL/TLS traffic
If you are in possession of the private key of a server from which you are examining recorded traffic, you can decrypt SSL/TLS-encrypted traffic from within Wireshark. You can configure this key by filling in the appropriate information in the `Edit -> Preferences -> RSA Keys -> Add new keyfile...` dialog.
#### Modifying displayed columns
Wireshark allows you to customize what columns are displayed for matching packets. These can be edited in the `Edit -> Preferences -> Columns`. It may be helpful to add the following columns to your output:
* Source port
* Destination port
#### Useful filters
There is a lot of traffic that is considered "ordinary" (i.e., you would see a lot of it in a PCAP on your computer outside of a CTF, too). A good way to filter it out is with something like:
```
not arp and not http and not (udp.port == 53)
```
Alternatively, if you want to keep the http traffic around, you can try (note that this will also exclude DNS over TCP, which you probably want to look at):
```
!(arp or icmp or dns or stp)
```
However, don't discount these classes of traffic just because they align with typical computer usage. DNS, HTTP, and even ARP can easily be an integral part of a PCAP analysis challenge.
Another useful thing to look at when doing something like examining malware is identify failed DNS requests, which involve some kind of C2 domain. This can be done with:
```
dns.flags.rcode != 0
```
To limit the displayed traffic to just what is occurring between two specific hosts, you can use:
```
ip.addr == 1.1.1.1 && ip.addr == 2.2.2.2
```
Abnormal TCP parameters can also be something worth looking into. Some of the below might be a good starting point:
* TCP resets - `tcp.flags.reset == 1`
* TCP pushes - `tcp.flags.push == 1`
### `tshark`
You can think of `tshark` as the command-line version of the Wireshark program. While you won't be getting a nice graphical output of your captured traffic with `tshark`, you will be able to get more creative with how your data is presented and then pass it off to other command-line programs.
#### Installation
`tshark` should already be on your system if you already have Wireshark installed.
#### Useful options to know
There are a few commonly-used options we will use in the below examples that you should be acquainted with. These are:
* `r` - TODO
* `q` - don't continuously display the count of packets, just show it at the very end
```
# bro/zeek
bro -Cr file.pcap
cat dhcp.log | bro-cut client_addr host_name | sort | uniq
cat files.log | bro-cut mime_type filename | grep “msword”
```
### zip file ?
* Save the `flag.zip` from http objects from the capture`File > Export Objects > HTTP > Select flag.zip > Save`
* Crack password using john
* `zip2john flag.zip > zip.hash`
* `john zip.hash`
### pcap ics
```
//try
0. packet comments.
1.filter by data
data == "password"
regex
data matches ".*example\.com.*"
2. cheack for any MITM and arp attacks
-> Is anyone sending a lot of ARP packets to the broadcast address saying he's xxxx ip ?
-> ARP spoofing attack?
eth.src == 00:0c:29:2a:0b:dd
-> Idenitfy the ip
-> IS the malicouous mac conatacting outside ip?
eth.src == malicous_mac_addr && ip.dst != ur_current_ip_subnet/16
3. component altered in ics ?
-> pressure?,temperature?,....
4. time of attack in network ?
```