<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-packet-captures
description: >-
  Deep packet inspection and PCAP analysis using tcpdump, Wireshark, tshark, and Zeek for network forensics, threat hunting, and incident response evidence collection.
domain: cybersecurity
subdomain: network-security
tags:
  - pcap
  - wireshark
  - tcpdump
  - tshark
  - zeek
  - packet-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1040", "T1557"]
  nist-csf: ["DE.CM-1", "RS.AN-3"]
  uuid: f55baf8b-654e-4415-9083-34d3958c5b60
---

# Analyzing Packet Captures

## Overview

Packet capture analysis is the foundational skill of network forensics. Every byte on the wire
tells a story — from initial reconnaissance to data exfiltration. This skill covers capturing
traffic with tcpdump, analyzing PCAPs with Wireshark/tshark, extracting artifacts with Zeek,
and correlating packet-level evidence with host-based telemetry.

Mode: `[MODE: BLUE]` for defensive analysis; `[MODE: INCIDENT]` for forensic investigation.

## Prerequisites

| Requirement | Details |
|---|---|
| tcpdump or dumpcap for live capture | Required |
| Wireshark / tshark for GUI and CLI analysis | Required |
| Zeek (formerly Bro) for protocol analysis and log generation | Required |
| Sufficient disk space for PCAPs (plan ~1GB per minute on busy links) | Required |
| Capture interface with promiscuous mode or span/tap port | Required |
| Python 3.10+ with scapy for scripted analysis | Required |

## Key Concepts

### Capture Strategies

```bash
# Full packet capture with rotation
tcpdump -i eth0 -w /captures/evidence_%Y%m%d_%H%M%S.pcap -G 3600 -C 500 -Z root

# Targeted capture — specific host
tcpdump -i eth0 -w suspect.pcap host 10.0.1.50 and not port 22

# Capture only DNS traffic
tcpdump -i eth0 -w dns_traffic.pcap port 53 or port 5353

# Ring buffer capture (keeps last N files)
dumpcap -i eth0 -b filesize:100000 -b files:10 -w /captures/ring.pcapng
```

### Wireshark Display Filters

```
# HTTP POST requests (credential harvesting)
http.request.method == "POST"

# DNS queries to suspicious TLDs
dns.qry.name contains ".xyz" or dns.qry.name contains ".top"

# TLS handshakes with self-signed certs
tls.handshake.type == 11 and x509sat.CountryName == ""

# TCP retransmissions (network issues or evasion)
tcp.analysis.retransmission

# Large DNS responses (tunneling indicator)
dns.resp.len > 512

# SMB lateral movement
smb2.cmd == 1 and smb2.filename contains "\\ADMIN$"

# Beaconing detection — regular interval connections
tcp.flags.syn == 1 and tcp.flags.ack == 0
```

### Zeek Protocol Analysis

```bash
# Generate logs from PCAP
zeek -r evidence.pcap local

# Key log files:
# conn.log     — All connections (5-tuple, duration, bytes)
# dns.log      — DNS queries and responses
# http.log     — HTTP requests with headers
# ssl.log      — TLS handshakes and certificates
# files.log    — File transfers detected
# notice.log   — Zeek-generated alerts

# Extract all transferred files
zeek -r evidence.pcap /opt/zeek/share/zeek/policy/frameworks/files/extract-all-files.zeek

# Find long-duration connections (C2 beaconing)
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p duration orig_bytes resp_bytes | \
  awk '$4 > 3600' | sort -t$'\t' -k4 -rn | head -20

# DNS exfiltration hunt
cat dns.log | zeek-cut query | awk '{print length, $0}' | sort -rn | head -20
```

### Scapy Packet Analysis

```python
from scapy.all import rdpcap, IP, TCP, DNS

packets = rdpcap("evidence.pcap")

# Extract unique source IPs
src_ips = set(p[IP].src for p in packets if IP in p)

# Find DNS queries
dns_queries = [p[DNS].qd.qname.decode() for p in packets if DNS in p and p[DNS].qd]

# Detect SYN scans
syn_packets = [p for p in packets if TCP in p and p[TCP].flags == "S"]
```

## Workflow

### Step 1: Capture

```bash
# Start capture on incident declaration
tcpdump -i eth0 -w /evidence/$(date +%Y%m%d_%H%M%S)_incident.pcap -s 0 \
  host $SUSPECT_IP
```

### Step 2: Initial Triage with tshark

```bash
# Protocol hierarchy — what protocols are present
tshark -r evidence.pcap -q -z io,phs

# Conversation summary — who talked to whom
tshark -r evidence.pcap -q -z conv,tcp

# Top talkers by bytes
tshark -r evidence.pcap -q -z endpoints,ip -o "gui.column.format:"Bytes","%B""
```

### Step 3: Zeek Log Generation

```bash
zeek -r evidence.pcap local
# Review conn.log for anomalous connections
# Review dns.log for tunneling indicators
# Review files.log for transferred malware
```

### Step 4: Deep Dive

```bash
# Extract HTTP objects
tshark -r evidence.pcap --export-objects http,/evidence/http_objects/

# Follow TCP stream of suspicious connection
tshark -r evidence.pcap -q -z follow,tcp,ascii,0

# Extract TLS certificates
tshark -r evidence.pcap -Y "tls.handshake.type==11" \
  -T fields -e x509sat.printableString
```

## Detection

```yaml
title: Packet Captures Detection
id: 7f1f3dd9-efa7-449e-94d1-52f17918e6cf
status: experimental
description: Detects suspicious activity related to analyzing packet captures techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1040
  - attack.t1557
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Packet Captures Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1040, T1557 |

## Verification

- [ ] Capture includes full packets (snaplen 0 / 65535)
- [ ] Evidence PCAP hashed (SHA256) for chain of custody
- [ ] Zeek logs generated and reviewed (conn, dns, http, ssl, files)
- [ ] Protocol hierarchy analyzed for unexpected protocols
- [ ] Top talkers and conversation pairs documented
- [ ] Suspicious files extracted and submitted to sandbox
- [ ] Timeline of network events correlated with host logs

## References

- [Wireshark Display Filter Reference](https://www.wireshark.org/docs/dfref/)
- [Zeek Documentation](https://docs.zeek.org/en/current/)
- [SANS PCAP Analysis Cheat Sheet](https://www.sans.org/posters/packet-capture/)
- NIST SP 800-86: Guide to Integrating Forensic Techniques
- MITRE ATT&CK T1040 — Network Sniffing
