Wireshark screenshot analyzing HTTP requests/responses and GET traffic

HTTP Analysis

  • http – All HTTP traffic
  • http.request – Requests
  • http.response – Responses
  • http contains "GET"
  • http.host == "example.com"
Wireshark screenshot of DNS queries and responses for google.com

DNS Queries

  • dns – All DNS traffic
  • dns.qry.name
  • dns.qry.name contains "google.com"
  • dns.flags.response == 0
Wireshark screenshot of TCP three-way handshake (SYN, SYN-ACK, ACK)

TCP Handshake

  • SYN
  • SYN-ACK
  • ACK
  • Retransmissions
Wireshark screenshot detecting Nmap SYN, NULL, FIN, and Xmas scans

Nmap Scan Detection

  • SYN Scan
  • NULL Scan
  • FIN Scan
  • Xmas Scan
Wireshark screenshot of ICMP ping requests and replies

ICMP Traffic

  • Ping request
  • Ping reply
Wireshark screenshot analyzing malware .exe downloads, C2 ports, and MZ headers

Malware Analysis

  • .exe downloads
  • C2 ports
  • .onion domains
  • MZ signature