<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 -->
<!-- NERF is a trademark of defconxt. -->
---
name: conducting-network-traffic-analysis-during-incident
description: >-
  Performs network traffic analysis during active incidents using tshark, Wireshark,
  Zeek, and tcpdump to identify C2 communications, data exfiltration, lateral
  movement, and DNS tunneling from packet captures.
domain: cybersecurity
subdomain: incident-response
tags:
  - network-forensics
  - pcap-analysis
  - tshark
  - zeek
  - C2-detection
  - exfiltration
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1040"]
---

# Conducting Network Traffic Analysis During Incident

## Overview

Network traffic analysis during an active incident identifies command-and-control
(C2) channels, data exfiltration streams, lateral movement patterns, and DNS
tunneling. Packet capture is often the only evidence source that reveals the full
scope of attacker communications when endpoint telemetry is compromised or
unavailable.

This skill covers live capture with tcpdump, offline analysis with tshark and
Wireshark display filters, automated connection logging with Zeek, and detection
of common attack patterns including beaconing, DNS tunneling, and encrypted
channel abuse.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| tshark / Wireshark | Packet analysis | `apt install tshark wireshark` |
| tcpdump | Live packet capture | `apt install tcpdump` |
| Zeek | Network security monitor | `apt install zeek` |
| ngrep | Network grep | `apt install ngrep` |
| CyberChef | Payload decoding | Web-based or Docker |

## Key Concepts

### C2 Beaconing Indicators

- Regular interval connections to single destination (jitter ±10-15%)
- Small request size, consistent response size
- Connections to recently registered domains or IP-only destinations
- HTTPS to non-standard ports or self-signed certificates
- DNS TXT queries with base64-encoded subdomains

### Exfiltration Patterns

- Large outbound transfers during off-hours
- DNS queries with high-entropy subdomain labels (tunneling)
- ICMP packets with unusual payload sizes
- HTTP POST with large body to uncommon destinations
- Encrypted streams to cloud storage APIs

## Workflow

### Step 1 — Capture Live Traffic

```bash
# Full packet capture on interface
tcpdump -i eth0 -w /evidence/capture.pcap -c 1000000

# Capture specific host traffic
tcpdump -i eth0 host 10.0.1.50 -w /evidence/host_traffic.pcap

# Capture DNS traffic only
tcpdump -i eth0 port 53 -w /evidence/dns.pcap
```

### Step 2 — Detect C2 Beaconing

```bash
# Identify regular interval connections (beaconing)
tshark -r capture.pcap -Y "tcp.flags.syn==1 && !tcp.flags.ack==1" \
  -T fields -e frame.time_epoch -e ip.dst -e tcp.dstport | \
  sort -k2 | awk '{print $2, $3, $1}' > /evidence/syn_times.txt

# Top talkers by destination
tshark -r capture.pcap -T fields -e ip.dst | sort | uniq -c | sort -rn | head -20

# HTTP beacons with user-agent analysis
tshark -r capture.pcap -Y "http.request" \
  -T fields -e frame.time -e ip.dst -e http.host -e http.user_agent | head -50
```

### Step 3 — Detect DNS Tunneling

```bash
# Long DNS queries (potential tunneling)
tshark -r capture.pcap -Y "dns.qry.name" \
  -T fields -e dns.qry.name | awk '{if(length($0)>50) print length($0), $0}' | sort -rn

# DNS TXT record responses (C2 data channel)
tshark -r capture.pcap -Y "dns.qry.type==16" \
  -T fields -e frame.time -e dns.qry.name -e dns.txt

# Unique DNS query volume per source
tshark -r capture.pcap -Y "dns.flags.response==0" \
  -T fields -e ip.src -e dns.qry.name | sort -u | cut -f1 | uniq -c | sort -rn
```

### Step 4 — Detect Data Exfiltration

```bash
# Large outbound transfers
tshark -r capture.pcap -Y "ip.src==10.0.0.0/8" \
  -T fields -e ip.src -e ip.dst -e frame.len | \
  awk '{bytes[$1" -> "$2]+=$3} END {for(k in bytes) print bytes[k], k}' | sort -rn | head -20

# HTTP POST with large payloads
tshark -r capture.pcap -Y "http.request.method==POST && tcp.len>1000" \
  -T fields -e frame.time -e ip.dst -e http.host -e tcp.len

# ICMP exfiltration (unusual payload sizes)
tshark -r capture.pcap -Y "icmp && data.len>64" \
  -T fields -e frame.time -e ip.dst -e data.len
```

### Step 5 — Zeek Connection Logs

```bash
# Process PCAP with Zeek
zeek -r /evidence/capture.pcap

# Analyze connection logs for long-duration sessions
cat conn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p duration orig_bytes resp_bytes | \
  sort -t$'\t' -k5 -rn | head -20

# DNS log analysis
cat dns.log | zeek-cut ts query qtype answers | grep -v "\.local" | sort -u
```

## Detection

```yaml
title: Network Traffic Analysis During Incident Detection
id: e48851db-8879-4152-aad4-6ae3f8102be5
status: experimental
description: Detects suspicious activity related to conducting network traffic analysis during incident techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*conducting*network*"
  condition: selection
level: high
tags:
  - attack.t1040
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools
```

## Verification

- [ ] Packet capture acquired from relevant network segments
- [ ] C2 beaconing analysis completed with interval detection
- [ ] DNS tunneling checks performed (query length, TXT records, entropy)
- [ ] Data exfiltration volume quantified by destination
- [ ] Zeek connection logs generated and long-duration sessions reviewed
- [ ] All suspicious external IPs documented as IOCs
- [ ] Network timeline correlated with endpoint evidence

## References

- tshark Documentation: https://www.wireshark.org/docs/man-pages/tshark.html
- Zeek Documentation: https://docs.zeek.org
- SANS Network Forensics Cheat Sheet (FOR572)
- MITRE ATT&CK T1071 (Application Layer Protocol)
- MITRE ATT&CK T1048 (Exfiltration Over Alternative Protocol)
- MITRE ATT&CK T1572 (Protocol Tunneling)
