---
name: rt-traffic-analysis
description: "Network traffic capture and analysis skill for authorized engagements. Wireshark capture filters and display filters, tcpdump workflows, credential extraction from pcap files, protocol identification, C2 traffic analysis, TLS fingerprinting (JA3/JA3S), detecting lateral movement in packet captures, and automated pcap analysis with NetworkMiner and Zeek. Use when analyzing captured network traffic, verifying C2 traffic profile, or investigating network-level evidence."
---

# rt-traffic-analysis — Network Traffic Capture & Analysis

## Overview

Traffic analysis in red teaming serves two purposes: finding credentials and sensitive data in captured traffic, and verifying that your own C2 traffic blends in and avoids detection signatures.

---

## Phase 1 — Capture Setup

```bash
# tcpdump — command line capture
# Capture all traffic on interface
tcpdump -i eth0 -w capture.pcap

# Capture specific host
tcpdump -i eth0 host 10.10.10.50 -w target.pcap

# Capture specific port range
tcpdump -i eth0 'port 80 or port 443 or port 8080' -w web.pcap

# Capture credentials (unencrypted protocols)
tcpdump -i eth0 'port 21 or port 23 or port 110 or port 143 or port 25' -w cleartext.pcap
# 21=FTP, 23=Telnet, 110=POP3, 143=IMAP, 25=SMTP

# Capture from remote host (pipe over SSH)
ssh user@PIVOT_HOST "tcpdump -i eth0 -w - 'not port 22'" | wireshark -k -i -

# Promiscuous mode (capture all traffic on segment)
tcpdump -i eth0 -p  # -p = don't use promiscuous (default on)
ip link set eth0 promisc on  # Enable promiscuous
```

---

## Phase 2 — Wireshark Filters

```bash
# Credential extraction filters

# HTTP POST requests (login forms)
http.request.method == "POST"

# HTTP basic auth
http.authorization

# FTP credentials
ftp.request.command == "PASS" or ftp.request.command == "USER"

# Telnet (capture stream)
telnet

# SMTP auth
smtp.auth

# NTLM authentication (all protocols)
ntlmssp

# Kerberos
kerberos

# DNS queries (C2 detection / data exfiltration detection)
dns

# Long DNS queries (possible DNS tunneling)
dns.qry.name.len > 50

# SMB file access
smb2.cmd == 5  # SMB2 Read

# Key display filters
ip.addr == 10.10.10.50                    # Traffic to/from specific host
ip.src == 10.10.10.0/24                   # From subnet
tcp.port == 4444                          # Specific port (C2 detection)
frame.len > 1400                          # Large packets
tcp.flags.syn == 1 && tcp.flags.ack == 0  # SYN scan detection
http.response.code == 200                 # Successful HTTP responses
ssl.handshake.type == 1                   # TLS Client Hello
```

---

## Phase 3 — Automated Credential Extraction

```bash
# NetworkMiner — GUI tool, auto-extracts credentials from pcap
# https://www.netresec.com/?page=NetworkMiner
mono NetworkMiner.exe capture.pcap
# Credentials tab → all extracted usernames/passwords

# PCredz — automated credential extraction
git clone https://github.com/lgandx/PCredz
python3 PCredz.py -f capture.pcap
# Extracts: HTTP Basic, FTP, Telnet, POP3, IMAP, SNMP community strings, NTLMv1/v2

# Dsniff tools
dsniff -p capture.pcap       # Extract passwords from pcap
urlsnarf -p capture.pcap     # Extract URLs
msgsnarf -p capture.pcap     # IM/chat messages
mailsnarf -p capture.pcap    # Email contents

# Extract HTTP credentials with tshark
tshark -r capture.pcap -Y "http.request.method==POST" \
  -T fields -e http.host -e http.request.uri -e urlencoded-form.value

# Extract all HTTP request bodies
tshark -r capture.pcap -Y "http" -T fields \
  -e ip.src -e ip.dst -e http.request.method \
  -e http.request.uri -e http.file_data

# NTLM hash extraction
tshark -r capture.pcap -Y "ntlmssp.auth" -T fields \
  -e ntlmssp.auth.username -e ntlmssp.auth.domain \
  -e ntlmssp.ntlmserverchallenge -e ntlmssp.auth.ntresponse
```

---

## Phase 4 — TLS Fingerprinting (JA3/JA3S)

```bash
# JA3 fingerprints identify TLS clients (browsers, malware, tools)
# JA3S fingerprints identify TLS servers
# Use to: verify your C2 traffic, detect blue team tools, identify malware

# Install ja3
pip3 install pyja3

python3 << 'EOF'
import pyshark

cap = pyshark.FileCapture('capture.pcap', display_filter='ssl.handshake.type==1')
for pkt in cap:
    try:
        ja3 = pkt.ssl.handshake_type
        print(f"Src: {pkt.ip.src} → JA3: {pkt.ssl.ja3}")
    except: pass
EOF

# Compare against known JA3 databases
# https://ja3er.com/
# Cobalt Strike default JA3: 72a7c4f3d7c7cdbf3f8b1c1e9dbf3c1f (well-known, blocked)
# → Use malleable profile to change JA3

# tshark JA3 extraction
tshark -r capture.pcap -Y "tls.handshake.type==1" \
  -T fields -e ip.src -e tls.handshake.ja3
```

---

## Phase 5 — C2 Traffic Verification

```bash
# Before engagement: verify your own C2 traffic blends in
# Capture your beacon traffic → analyze for detection signatures

# Check beacon interval regularity (beacons are too regular = detectable)
python3 << 'EOF'
from scapy.all import rdpcap, IP
import statistics

pkts = rdpcap("c2_traffic.pcap")
times = [p.time for p in pkts if IP in p and p[IP].dst == "C2_IP"]
intervals = [times[i+1]-times[i] for i in range(len(times)-1)]
print(f"Mean interval: {statistics.mean(intervals):.2f}s")
print(f"Std deviation: {statistics.stdev(intervals):.2f}s")
# Low stdev = too regular → increase jitter in C2 profile
EOF

# Check packet sizes (uniform sizes = suspicious)
tshark -r c2_traffic.pcap -T fields -e frame.len | sort | uniq -c | sort -rn | head -10
# All same size = suspicious → add padding in malleable profile

# Check DNS query frequency
tshark -r c2_traffic.pcap -Y dns -T fields -e dns.qry.name | \
  awk '{print $1}' | sort | uniq -c | sort -rn | head -20
# Unusual subdomains or high frequency = DNS C2 signature
```

---

## Phase 6 — Zeek (Bro) Analysis

```bash
# Zeek generates structured logs from pcap — easier to query than raw pcap
apt install zeek -y

# Analyze pcap
zeek -r capture.pcap
ls *.log
# conn.log = all connections
# http.log = HTTP requests
# dns.log = DNS queries
# ssl.log = TLS connections
# files.log = transferred files
# weird.log = protocol anomalies

# Find C2 beacons (regular connections)
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p duration | \
  awk '$4 < 1' | sort | uniq -c | sort -rn | head -20
# Regular short connections to same host = beacon pattern

# DNS tunneling detection
cat dns.log | zeek-cut query | awk '{print length($1), $1}' | \
  sort -rn | head -20 | awk '$1 > 50'
# Long DNS queries = tunneling

# Data exfiltration detection
cat conn.log | zeek-cut id.orig_h id.resp_h orig_bytes | \
  sort -k3 -rn | head -10
# Large outbound transfers

# HTTP user-agent analysis
cat http.log | zeek-cut user_agent | sort | uniq -c | sort -rn
# Unusual user agents = custom tools
```

---

## Phase 7 — Protocol Identification

```bash
# Identify unknown protocols in captures

# Wireshark: Analyze → Decode As → try different protocols

# tshark protocol summary
tshark -r capture.pcap -q -z io,phs
# Shows protocol hierarchy

# Find non-standard ports with known protocols
tshark -r capture.pcap -q -z conv,tcp | head -20
# Port 4444, 8888 etc = likely C2

# ngrep — grep through packet payloads
ngrep -q -I capture.pcap "password|secret|token" tcp

# strings on pcap
strings capture.pcap | grep -iE "password|api_key|secret|token|Authorization"

# Identify binary protocols by magic bytes
python3 << 'EOF'
from scapy.all import rdpcap, Raw
pkts = rdpcap("capture.pcap")
for pkt in pkts:
    if Raw in pkt:
        payload = bytes(pkt[Raw])
        if payload[:2] == b'\x4d\x5a':
            print("PE executable in traffic!")
        elif payload[:4] == b'\x50\x4b\x03\x04':
            print("ZIP file in traffic!")
        elif b'JFIF' in payload[:20] or b'\xff\xd8\xff' == payload[:3]:
            print("JPEG in traffic!")
EOF
```

---

## Skill Levels

**BEGINNER:** tcpdump capture + Wireshark display filters for credentials · PCredz automated extraction

**INTERMEDIATE:** JA3 fingerprinting + C2 traffic profiling · Zeek analysis + DNS tunneling detection

**ADVANCED:** Custom Zeek scripts for behavioral analysis · Beacon interval analysis + jitter verification

**EXPERT:** ML-based traffic classification · Custom protocol dissectors · Full traffic replay and modification

---

## References

- Wireshark display filters: https://wiki.wireshark.org/DisplayFilters
- PCredz: https://github.com/lgandx/PCredz
- Zeek: https://zeek.org
- JA3: https://github.com/salesforce/ja3
- MITRE T1040: https://attack.mitre.org/techniques/T1040/
